Critical vulnerability in widely used software

A critical vulnerability has been discovered in a software development module that is used by many businesses. The vulnerability in the Apache Log4j 2 library, also known as 'Log4Shell', has been raised to critical status by the UK's National Cyber Security Centre.

"This software library is used by many developers for both commercially available and bespoke software. We are encouraging all customers to ensure they are running the latest, secure versions of their software or to speak to their software developers to ensure this security issue is fixed. Moving to the latest version of Log4j 2 will resolve the issue," explains Chris Joberns, managing director at Strident.

The vulnerability could allow hackers to take control of the software. A listing of vulnerable software is being compiled here with information on status and resolutions.

What is the Log4j 2 library?

The Apache Software Foundation provides support for more than 350 Apache Projects and their communities, with a mission to provide open source software for the public good. It is most famous for producing the code that runs many of the world's web servers and is freely licensed, making its use very popular.

Log4j 2 is an open-source Java logging library developed by the foundation and is used in many applications. The Log4j 2 library is frequently used in enterprise Java software and is included in various Apache frameworks. This can include applications that run locally as well as in the cloud.

What to do?

The National Cyber Security Centre recommends identifying software using the Log4j 2 library and then ensuring that software is patched to the latest secure version. Click here to discover more details on the NCSC website. If in doubt, speak with your software supplier.

To find out more about Strident's outstanding IT support service, please call Strident on 01473 835 280.