Apache Log4j Vulnerability Allow Attackers to Intercept Sensitive Log Data

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apache Log4j Vulnerability Exposes Sensitive Log Data to Attackers Apache Logging Services has disclosed a critical vulnerability in Log4j Core that allows attackers to intercept sensitive log data. This flaw affects versions 2.0-beta9 through 2.25.2, specifically in the Socket Appender component, which fails to verify TLS, enabling potential man-in-the-middle attacks. Users of the affected versions are urged to update to secure their applications. 4 sources 45