On December 9th 2021, Apache published a zero-day vulnerability (CVE-2021-44228) for Apache Log4j being referred to as “Log4Shell.” This vulnerability has been classified as “Critical” with a CVSS score of 10, allowing for Remote Code Execution with system-level privileges.
If you are currently working to identify instances of this vulnerability, Tripwire can help.
Tripwire IP360
Tripwire IP360 can be configured to detect the vulnerability through application scanning. IP360’s ASPL-978 includes multiple checks for identifying instances of the Log4Shell vulnerability (CVE-2021-44228) using either DRT or non-DRT scanning.
The following content checks are available now. We will continue to update this post.
- DSA-5020: apache-log4j2 CVE-2021-44228 Vulnerability
- IBM WebSphere Application Server CVE-2021-44228 Vulnerability
- Apache Log4j2 LogShell Remote Code Execution Vulnerability via Classpath Registry Keys
- Elasticsearch CVE-2021-44228 Information Disclosure Vulnerability
- VMSA-2021-0028: CVE-2021-44228 vCenter Server Apache Log4j Remote Code Execution Vulnerability
If you need help applying these content checks, please visit our IP360 Coverage Guide, located here within our Tripwire Customer Center.
Tripwire Enterprise
Tripwire Enterprise Users:
Tripwire Enterprise has added detection for the vulnerable Log4J to the policies listed:
- High Impact Vulnerabilities Linux
- High Impact Vulnerabilities Windows
More information can be found here, within our Tripwire Customer Center.
Tripwire continues to work on additional checks to help you address log4j2. For real-time updates on available content checks, as well as Tripwire software that has been investigated regarding the Log4j vulnerability, visit this page.
Request a Live Demo
Experience the power of Tripwire's cybersecurity solutions firsthand! Take a guided tour or participate in live demos to see how our products can enhance your organization's security. Start exploring now
