[ad_1]
The Cybersecurity and Infrastructure Safety Company (CISA) has launched an open supply scanner that companies can use to search out Internet providers weak to Log4j distant code execution vulnerabilities CVE-2021-44228 and CVE-2021-45046.
“Log4j-scanner is a undertaking derived from different members of the open-source neighborhood by CISA to assist organizations establish doubtlessly weak net providers affected by log4j vulnerabilities,” CISA officers wrote on GitHub.
The knowledge and code within the repository have been supplied “as is,” assembled with assist from the open supply neighborhood, and up to date by CISA by way of a collaboration with the broader safety neighborhood, they famous.
Officers famous there are probably extra, nonetheless unknown methods to make use of the Log4j vulnerabilities and that CISA is monitoring a number of platforms to remain updated because the scenario evolves.
In a tweet
posted Dec. 21, Secretary Alejandro Mayorkas reported the Log4j vulnerability can even be included within the scope of the brand new “Hack DHS” bug bounty program introduced Dec. 15. This system will embody further incentives to search out and patch Log4j-related flaws in DHS methods, Mayorkas wrote.
Take a look at the CISA scanner on GitHub.
[ad_2]
