Episode 1 · 1:27

The Message Was Logged

Prefer to watch it? The same episode on YouTube.

Do not treat a logging library as harmless background plumbing. A vulnerable dependency can turn ordinary attacker-controlled text into code execution.

Severity
10.0 Critical
Vulnerability
(Log4Shell)
OWASP
A06:2021 Vulnerable and Outdated Components

Do not treat a logging library as harmless background plumbing. A vulnerable dependency can turn ordinary attacker-controlled text into code execution.

Whale and Urchin discuss CVE-2021-44228 (Log4Shell) with the appropriate amount of corporate urgency: almost none. The episode runs 87 seconds.

The vulnerability#

CVE-2021-44228 (Log4Shell) is scored 10.0 Critical. It sits under A06:2021 Vulnerable and Outdated Components.

Sources#

The joke only works if the vulnerability is real. These are the primary records:

Transcript
Whale & Urchin Discuss the Incident Episode 01 The Message Was Logged Whale: "We have received a message, Urchin." Urchin: "That is true." Whale: "It was only written to the logs." Urchin: "That is where logs go." Whale: "The message contained a lookup." Urchin: "I see." Whale: "It brought something back." Urchin: "Yes." Whale: "Then it ran it." Urchin: "That is less usual." Whale: "The library was only for logging." Whale: "It was a very common library." Urchin: "That is how it visited everyone." Whale: "The score is ten, Urchin." Urchin: "Yes." Whale: "Out of ten." Urchin: "Also yes." Whale: "I have made a ticket." Whale: "It says the impact is widespread." Urchin: "That is a calm word." Whale: "I have upgraded the library." Urchin: "Good." Whale: "I have also restarted the service." Urchin: "Better." Whale: "The message is still in the logs." Urchin: "Yes." Whale: "But it is only a message now." Urchin: "That is a better kind of message." Whale: "We have learned from this." Urchin: "We have written it down." Whale: "In the runbook." Urchin: "Yes." CVE-2021-44228 · CVSS 10.0 Critical Patch the thing that only logs things.

Sources

The joke only works if the vulnerability is real. These are the primary records.