CISA launches webpage, repository on Apache Log4j vulnerability

Dec 14, 2021 - 11:53 AM
Cybersecurity Lock on Gold Wall

The Cybersecurity and Infrastructure Security Agency has created a webpage to provide the latest public information and vendor-supplied advisories on a critical remote code execution vulnerability affecting Apache Log4j software library versions 2.0-beta9 to 2.14.1. CISA urges organizations to review the webpage and immediately upgrade to Log4j version 2.15.0 or apply the appropriate vendor-recommended mitigations, because an unauthenticated remote actor could exploit this vulnerability to take control of an affected system. CISA and its Joint Cyber Defense Collaborative partners are tracking the vulnerability, and CISA will continue to update the webpage as additional information becomes available. Log4j is broadly used in a variety of consumer and enterprise services, websites, applications and operational technology products to log security and performance information. For more information on this or other cyber and risk issues, contact John Riggi, senior advisor for cybersecurity and risk, at jriggi@aha.org. 

Related News Articles

Headline
Agencies warn of Chinese government-linked cyber actors using hacking tools to steal sensitive data
A joint advisory released Oct. 8 by U.S. and international agencies warns of Chinese government-linked cyber threat actors using automated and hands-on hacking…
Headline
NSA recommends adoption of zero trust controls to improve cybersecurity of essential functions
The National Security Agency Oct. 8 released guidance for critical infrastructure organizations that recommends adopting high-impact zero trust strategies to…
Headline
Agencies warn of credential-compromising campaign actively targeting critical infrastructure networks
The FBI and Secret Service released an advisory Oct. 6 warning of ongoing activities by FortiBleed, a global credential-compromise campaign used by threat…
Headline
Blog explores how clinical continuity and collaboration strengthen cyber resilience
In a new blog, John Riggi, AHA national advisor for cybersecurity and risk, and Scott Gee, AHA deputy national advisor for cybersecurity and risk, highlight…
Headline
Senate passes Health Care Cybersecurity and Resilience Act
The Senate passed the Health Care Cybersecurity and Resilience Act on Sept. 30 by unanimous consent. The bipartisan bill seeks to improve coordination between…
Headline
AHA comments on cybersecurity, AI attacks for Senate Homeland Security subcommittee hearing
The AHA provided comments Sept. 30 to the Senate Homeland Security and Governmental Affairs Subcommittee on Disaster Management, District of Columbia and…