news.volyx.in

Third High Severity CVE in Log4j Is Published (logging.apache.org)

432 points by niros_valtos · 1736 days ago · 312 comments on HN

Article summary

A third high-severity CVE has been published for Log4j, a widely used logging library. The Logging Services Security Team takes security seriously and provides guidance on security-related issues and known vulnerabilities. Log4j 1 has reached End of Life and is no longer supported, and users are advised to upgrade to Log4j 2 to obtain security fixes. The team also provides instructions on how to report vulnerabilities and emphasizes the importance of following security guidelines.

Main themes

  • Log4j vulnerability
  • IT security responsibility
  • Software supply chain transparency
  • Compiled languages and patching
  • Source code access and security
  • Version control and build pipelines
  • Vulnerability remediation
  • Security optimization for average companies
  • Code escrow and dependency vulnerability databases

What commenters say

  • Some argue that the blame for the vulnerability lies with IT security teams of large organizations that were unprepared to update a widely used dependency.
  • Others believe that the issue is not with the dependency itself, but with the lack of transparency and accountability in the software supply chain.
  • There is a disagreement on whether compiled languages make it harder to patch vulnerabilities, with some arguing that it is a non-issue and others claiming that it can lead to significant security risks.
  • Some commenters suggest that having access to source code can help mitigate vulnerabilities, while others argue that it is not a realistic solution for many organizations.
  • The importance of maintaining a link between deployed systems and their source code is emphasized, with some suggesting that this can be achieved through version control and build pipelines.
  • There is a discussion on the challenges of remediating vulnerabilities in complex systems with multiple dependencies and third-party components.
  • Some argue that optimizing security for the average company, rather than just those with best practices, is crucial for improving overall security.
  • The use of code escrow and dependency vulnerability databases is proposed as a potential solution to mitigate the risks associated with vulnerabilities in third-party dependencies.