Security Notice: Apache Log4j Remote Code Execution (RCE) Log4shell Vulnerability (CVE-2021-44228)

Micah

Apache Log4j project disclosed CVE-2021-44228, which is a Critical (CVSS 10.0) remote code execution vulnerability affecting Apache Log4j2 version<= 2.14.1. A subsequent security patch was released on Dec 10, 2021.

SonicWall has observed widespread scanning and exploitation of this vulnerability over the internet using a publicly available PoC (Proof of Concept) exploit. SonicWall is currently investigating its product line to scope and impact, as utilization of Log4j does not immediately suggest exploitation is possible.

Please see the following resources to learn more:

• PSIRT Advisory: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
• Support Notice: https://www.sonicwall.com/support/notices/211214102517010
• SonicAlert: https://securitynews.sonicwall.com/xmlpost/apache-log4j-rce-vulnerability/

tbrame

Any idea when SonicWall is going to clean up the ESA code?

https://community.sonicwall.com/technology-and-support/discussion/3386/es-vulnerable-to-log4shell#latest

Micah

https://community.sonicwall.com/technology-and-support/discussion/comment/12450#Comment_12450

The security advisory has been updated and as of this post states, "Firmware security patch 10.0.12 is available for download."

Please refer to the security advisory for a full update.

Kind Regards,