1"use strict";(self.webpackChunkpartners=self.webpackChunkpartners||[]).push([[28760],{15680:(e,t,r)=>{r.d(t,{xA:()=>u,yg:()=>h});var a=r(96540);function i(e,t,r){return t in e?Object.defineProperty(e,t,{value:r,enumerable:!0,configurable:!0,writable:!0}):e[t]=r,e}function o(e,t){var r=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),r.push.apply(r,a)}return r}function n(e){for(var t=1;t<arguments.length;t++){var r=null!=arguments[t]?arguments[t]:{};t%2?o(Object(r),!0).forEach((function(t){i(e,t,r[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(r)):o(Object(r)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(r,t))}))}return e}function l(e,t){if(null==e)return{};var r,a,i=function(e,t){if(null==e)return{};var r,a,i={},o=Object.keys(e);for(a=0;a<o.length;a++)r=o[a],t.indexOf(r)>=0||(i[r]=e[r]);return i}(e,t);if(Object.getOwnPropertySymbols){var o=Object.getOwnPropertySymbols(e);for(a=0;a<o.length;a++)r=o[a],t.indexOf(r)>=0||Object.prototype.propertyIsEnumerable.call(e,r)&&(i[r]=e[r])}return i}var s=a.createContext({}),c=function(e){var t=a.useContext(s),r=t;return e&&(r="function"==typeof e?e(t):n(n({},t),e)),r},u=function(e){var t=c(e.components);return a.createElement(s.Provider,{value:t},e.children)},y="mdxType",p={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},d=a.forwardRef((function(e,t){var r=e.components,i=e.mdxType,o=e.originalType,s=e.parentName,u=l(e,["components","mdxType","originalType","parentName"]),y=c(r),d=i,h=y["".concat(s,".").concat(d)]||y[d]||p[d]||o;return r?a.createElement(h,n(n({ref:t},u),{},{components:r})):a.createElement(h,n({ref:t},u))}));function h(e,t){var r=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var o=r.length,n=new Array(o);n[0]=d;var l={};for(var s in t)hasOwnProperty.call(t,s)&&(l[s]=t[s]);l.originalType=e,l[y]="string"==typeof e?e:i,n[1]=l;for(var c=2;c<o;c++)n[c]=r[c];return a.createElement.apply(null,n)}return a.createElement.apply(null,r)}d.displayName="MDXCreateElement"},75279:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>s,contentTitle:()=>n,default:()=>p,frontMatter:()=>o,metadata:()=>l,toc:()=>c});var a=r(58168),i=(r(96540),r(15680));const o={slug:"2021-12-16-log4j-security-advisory",title:"Security Advisory - Apache Log4j (CVE-2021-44228)",author:"Matt Fellows",author_title:"Co-founder @ PactFlow",author_url:"https://github.com/mefellows",author_image_url:"https://secure.gravatar.com/avatar/32ca6dc55ad8675eaea178f42926f608",tags:["log4j","security"]},n=void 0,l={permalink:"/notices/2021-12-16-log4j-security-advisory",editUrl:"https://github.com/pactflow/docs.pactflow.io/edit/master/website/blog/notices/2021-12-16-log4j-security-advisory.md",source:"@site/notices/2021-12-16-log4j-security-advisory.md",title:"Security Advisory - Apache Log4j (CVE-2021-44228)",description:"This security advisory provides customers with an update on how PactFlow services are affected by the Apache Log4j vulnerability (CVE-2021-44228). This vulnerability has been referred to as Log4Shell by some outlets.",date:"2021-12-16T00:00:00.000Z",formattedDate:"December 16, 2021",tags:[{label:"log4j",permalink:"/notices/tags/log-4-j"},{label:"security",permalink:"/notices/tags/security"}],readingTime:.985,hasTruncateMarker:!1,authors:[{name:"Matt Fellows",title:"Co-founder @ PactFlow",url:"https://github.com/mefellows",imageURL:"https://secure.gravatar.com/avatar/32ca6dc55ad8675eaea178f42926f608"}],frontMatter:{slug:"2021-12-16-log4j-security-advisory",title:"Security Advisory - Apache Log4j (CVE-2021-44228)",author:"Matt Fellows",author_title:"Co-founder @ PactFlow",author_url:"https://github.com/mefellows",author_image_url:"https://secure.gravatar.com/avatar/32ca6dc55ad8675eaea178f42926f608",tags:["log4j","security"]},prevItem:{title:"On-premises release v1.14.2",permalink:"/notices/2022-01-31-on-premises-1.14.2"},nextItem:{title:"On-premises release v1.14.1",permalink:"/notices/2021-12-07-on-premises-1.14.1"}},s={authorsImageUrls:[void 0]},c=[{value:"What is this vulnerability?",id:"what-is-this-vulnerability",level:2},{value:"How does this vulnerability affect PactFlow?",id:"how-does-this-vulnerability-affect-pactflow",level:2},{value:"What actions should I take?",id:"what-actions-should-i-take",level:2},{value:"Where can I find more information?",id:"where-can-i-find-more-information",level:2}],u={toc:c},y="wrapper";
1function p(e){let{components:t,...r}=e;return(0,i.yg)(y,(0,a.A)({},u,r,{components:t,mdxType:"MDXLayout"}),(0,i.yg)("p",null,"This security advisory provides customers with an update on how PactFlow services are affected by the Apache Log4j vulnerability (CVE-2021-44228). This vulnerability has been referred to as Log4Shell by some outlets."),(0,i.yg)("h2",{id:"what-is-this-vulnerability"},"What is this vulnerability?"),(0,i.yg)("p",null,"A Remote Code Execution (RCE) vulnerability was discovered in the popular Java logging library, Log4j. This industry-wide security vulnerability allows for an unauthenticated adversary to execute code on systems that have this library deployed, by providing specific crafted content. This is a serious vulnerability that affects many software products and online services."),(0,i.yg)("h2",{id:"how-does-this-vulnerability-affect-pactflow"},"How does this vulnerability affect PactFlow?"),(0,i.yg)("p",null,"PactFlow immediately began investigating its environment to identify any affected systems. After an investigation was completed, it was determined that:"),(0,i.yg)("ul",null,(0,i.yg)("li",{parentName:"ul"},"The Log4j library is not implemented in any of PactFlow's application services or SDKs;"),(0,i.yg)("li",{parentName:"ul"},"The Log4j library is not used by any of our open source clients (e.g. Pact JVM).")),(0,i.yg)("h2",{id:"what-actions-should-i-take"},"What actions should I take?"),(0,i.yg)("p",null,"Users of Pact or PactFlow do not need to take any action at this time."),(0,i.yg)("h2",{id:"where-can-i-find-more-information"},"Where can I find more information?"),(0,i.yg)("p",null,"Additional information on this vulnerability can be found here:"),(0,i.yg)("ul",null,(0,i.yg)("li",{parentName:"ul"},"Apache Software Foundation: ",(0,i.yg)("a",{parentName:"li",href:"https://logging.apache.org/log4j/2.x/security.html"},"Apache Log4j Security Vulnerabilities")),(0,i.yg)("li",{parentName:"ul"},"National Vulnerability Database: ",(0,i.yg)("a",{parentName:"li",href:"https://nvd.nist.gov/vuln/detail/CVE-2021-44228"}
1,"CVE-2021-44228"))))}p.isMDXComponent=!0}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.