Security News > 2021 > December > Log4j RCE: Emergency patch issued to plug critical auth-free code execution hole in widely-used logging utility
![Log4j RCE: Emergency patch issued to plug critical auth-free code execution hole in widely-used logging utility](/static/build/img/news/log4j-rce-emergency-patch-issued-to-plug-critical-auth-free-code-execution-hole-in-widely-used-logging-utility-medium.jpg)
An unauthenticated remote code execution vulnerability in Apache's Log4j Java-based logging tool is being actively exploited, researchers have warned after it was used to execute code on Minecraft servers.
The Apache Foundation published a patch for the critical-rated vuln earlier today.
Its patch notes confirmed: "An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled."
Immersive Labs' application security specialist Sean Wright told The Register that while immediate patches are available, it may be better to mitigate now and wait for a stable candidate.
"While there are release candidates for the patches, they are not stable releases and can carry their own risks, so apply the temporary remediation until you can apply the patch from a stable version."
"Updating the log4j-core.jar to version 2.15.0, which was released today, fixes the problem. But we are now in December and many online services are going to be in a change freeze at this point in time - meaning the business won't tolerate downtime to patch the issue. It will be interesting if this is seen to propagate into retail."
News URL
Related news
- Critical Windows licensing bugs, plus two others under attack, top Patch Tuesday (source)
- CISA warns critical Geoserver GeoTools RCE flaw is exploited in attacks (source)
- Critical Apache HugeGraph Vulnerability Under Attack - Patch ASAP (source)
- Progress warns of critical RCE bug in Telerik Report Server (source)
- Critical ServiceNow RCE flaws actively exploited to steal credentials (source)
- Critical Flaw in Telerik Report Server Poses Remote Code Execution Risk (source)
- Progress fixes critical RCE flaw in Telerik Report Server, upgrade ASAP! (CVE-2024-6327) (source)
- Critical Apache OFBiz pre-auth RCE flaw fixed, update ASAP! (CVE-2024-38856) (source)
- Critical Progress WhatsUp RCE flaw now under active exploitation (source)
- Critical Security Flaw in WhatsUp Gold Under Active Attack - Patch Now (source)