Red alert from Federal Office for Information Security: The Log4j vulnerability is keeping web services and users on edge. AEB has already implemented security measures.
Apple, Twitter, Amazon: Almost all web services are affected by the security vulnerability in the Java library Log4j. Even before the German Federal Office for Information Security declared the highest warning level, all security measures had already been initiated at AEB. AEB specialists examined the systems and have already implemented patches or defense mechanisms where necessary.
Since there are no significant new findings regarding new and critical Log4j vulnerabilities, we do not expect to make any further updates to this article. All other vulnerabilities with regards to Log4j will handled by AEB as part of the normal vulnerability process.
New findings on Log4j are constantly monitored and systems are protected/patched accordingly. AEB also responds immediately to the further critical vulnerabilities that have been discovered.
The following still applies: AEB systems are safe from these vulnerabilities based on current knowledge. This applies to AEB cloud applications as well as on-premise installations. Our measures, as described here, address the following vulnerabilities in particular:
Our measures, as described here, address the following Log 4j1 version 1.x vulnerabilities in particular:
In Log4j2 version 2.x
Your systems are not affected:
If any used 3rd party components were vulnerable to an external attack, they were either already patched to the latest version, necessary workarounds were implemented, or the systems were replaced. In addition, the security measures implemented in several places protect your solution from exploitation of this and other vulnerabilities. This is confirmed by regular vulnerability scans and penetration tests.
You do not need to adapt or patch on-premise solutions (as long as they are still being maintained).
In some cases, on-premise solutions from AEB use Log4j components in version 1.x. However, the affected sub-components are not used by AEB and the configuration is also restricted, e. g. it only allows predefined appenders.
Based on further developments regarding the “Log4j vulnerability”, AEB has further analyzed its systems and solutions and adjusted them to the new findings where necessary.
The following still applies: AEB systems are safe from this vulnerability based on current knowledge. This applies to AEB cloud applications as well as on-premise installations.
