Zabbix NOT AFFECTED by the Log4j exploit

A newly revealed vulnerability impacting Apache Log4j 2 versions 2.0 to 2.14.1 was disclosed on GitHub on 9 December 2021 and registered as CVE-2021-44228 with the highest severity rating. Log4j is an open-source, Java-based logging utility widely used by enterprise applications and cloud services. By utilizing this vulnerability, a remote attacker could take control of the affected system.

Zabbix is aware of this vulnerability, has completed verification, and can conclude that the only product where we use Java is Zabbix Java Gateway, which does not utilize the log4j library, thereby is not impacted by this vulnerability.

For customers, who use the log4j library with other Java applications, here are some proactive measures, which they can take to reduce the risk posed by CVE-2021-44228:

• Upgrade to Apache log4j-2.1.50.rc2, as all prior 2.x versions are vulnerable.
• For Log4j version 2.10.0 or later, block JNDI from making requests to untrusted servers by setting the configuration value log4j2.formatMsgNoLookups to “TRUE” to prevent LDAP and other queries.
• Default both com.sun.jndi.rmi.object.trustURLCodebase and com.sun.jndi.cosnaming.object.trustURLCodebase to “FALSE” to prevent Remote Code Execution attacks in Java 8u121.

fake_first_name_45359 fake_last_name_45359

Zabbix Certified Expert & Trainer

Prev Post Next Post

Subscribe

Connect withD

Login

I allow to create an account

When you login first time using a Social Login button, we collect your account public profile information shared by Social Login provider, based on your privacy settings. We also get your email address to automatically create an account for you in our website. Once your account is created, you'll be logged-in to this account.

DisagreeAgree

Notify of

new follow-up comments new replies to my comments

Connect withD

I allow to create an account

When you login first time using a Social Login button, we collect your account public profile information shared by Social Login provider, based on your privacy settings. We also get your email address to automatically create an account for you in our website. Once your account is created, you'll be logged-in to this account.

DisagreeAgree

Please login to comment

5 Comments

Oldest

Newest Most Voted

Inline Feedbacks

View all comments

author_85248

4 years ago

This is a placeholder comment.

0

author_85249

4 years ago

This is a placeholder comment.

0

author_85253

4 years ago

This is a placeholder comment.

0

author_85264

4 years ago

Reply to  author_85253

This is a placeholder comment.

0

author_85259

4 years ago

This is a placeholder comment.

0