Cyber Security Alerts

Click the link below to view the recording for the Cyber Security Summit Kick off Meeting held on 23 February 2022

 

 

The password will be send via email with the notice for this link.

Subject: Message from the MS-ISAC: CISA Creates Webpage for Apache Log4j Vulnerability CVE-2021-44228 - TLP: WHITE

 

TLP: WHITE

 

TO: All MS-ISAC Members

 

Current Activity: CISA Creates Webpage for Apache Log4j Vulnerability CVE-2021-44228

 

Greetings state, local, tribal, and territorial partners,

 

CISA has released TLP:WHITE Current Activity: CISA Creates Webpage for Apache Log4j Vulnerability CVE-2021-44228.

 

CISA and its partners are tracking and responding to active, widespread exploitation of a critical remote code execution vulnerability (CVE-2021-44228) affecting Apache Log4j software library versions 2.0-beta9 to 2.14.1. Log4j is very broadly used in a variety of consumer and enterprise services, websites, and applications—as well as in operational technology products—to log security and performance information. An unauthenticated remote actor could exploit this vulnerability to take control of an affected system.

 

In response, CISA has created a webpage, Apache Log4j Vulnerability Guidance and will actively maintain a community-sourced GitHub repository of publicly available information and vendor-supplied advisories regarding the Log4j vulnerability. CISA will continually update both the webpage and the GitHub repository.

 

CISA Recommendation:

• CISA urges organizations to review its Apache Log4j Vulnerability Guidance webpage and upgrade to Log4j version 2.15.0, or apply the appropriate vendor recommended mitigations immediately. CISA will continue to update the webpage as additional information becomes available. 

 

We kindly request any incidents related to exploitation of this vulnerability to be reported to CISA at: Report Incidents, Phishing, Malware, or Vulnerabilities.