What it is about

Apache log4j ist ein Framework zum Loggen von Anwendungsmeldungen in Java. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Apache log4j ausnutzen, um Informationen offenzulegen.

Under what conditions?

Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.

What can happen in the worst case

An attacker could use the vulnerability to

• Informationen offenzulegen

Am I affected?

Affected according to the BSI:

• IBM Operational Decision Manager 8.11.1.0
• IBM Operational Decision Manager 9.0.0.1
• IBM Operational Decision Manager 8.11.0.1
• IBM Operational Decision Manager 8.12.0.1
• Debian Linux
• HCL Domino Rest API
• SUSE Linux
• IBM License Metric Tool
• IBM SPSS Modeler
• IBM Security Guardium Key Lifecycle Manager 4.1.1
• IBM QRadar SIEM
• IBM Security Guardium Key Lifecycle Manager 4.2

and 23 more

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• Apache log4j 2.25.3
• Splunk Splunk Enterprise 10.4.0
• Splunk Splunk Enterprise 10.2.4
• Splunk Splunk Enterprise 10.0.7
• Splunk Splunk Enterprise 9.4.12
• Splunk Splunk Enterprise 9.3.13
• IBM License Metric Tool 9.2.44
• IBM Planning Analytics Local 2.1.22
• IBM QRadar SIEM 7.5.0 UP16

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.