Episode 1 ยท 1:27
The Message Was Logged
Do not treat a logging library as harmless background plumbing. A vulnerable dependency can turn ordinary attacker-controlled text into code execution.
- Severity
- 10.0 Critical
- Vulnerability
- (Log4Shell)
- OWASP
- A06:2021 Vulnerable and Outdated Components
Do not treat a logging library as harmless background plumbing. A vulnerable dependency can turn ordinary attacker-controlled text into code execution.
Whale and Urchin discuss CVE-2021-44228 (Log4Shell) with the appropriate amount of corporate urgency: almost none. The episode runs 87 seconds.
The vulnerability#
CVE-2021-44228 (Log4Shell) is scored 10.0 Critical. It sits under A06:2021 Vulnerable and Outdated Components.
Sources#
The joke only works if the vulnerability is real. These are the primary records:
Transcript
Whale & Urchin Discuss the Incident
Episode 01 The Message Was Logged
Whale: "We have received a message, Urchin."
Urchin: "That is true."
Whale: "It was only written to the logs."
Urchin: "That is where logs go."
Whale: "The message contained a lookup."
Urchin: "I see."
Whale: "It brought something back."
Urchin: "Yes."
Whale: "Then it ran it."
Urchin: "That is less usual."
Whale: "The library was only for logging."
Whale: "It was a very common library."
Urchin: "That is how it visited everyone."
Whale: "The score is ten, Urchin."
Urchin: "Yes."
Whale: "Out of ten."
Urchin: "Also yes."
Whale: "I have made a ticket."
Whale: "It says the impact is widespread."
Urchin: "That is a calm word."
Whale: "I have upgraded the library."
Urchin: "Good."
Whale: "I have also restarted the service."
Urchin: "Better."
Whale: "The message is still in the logs."
Urchin: "Yes."
Whale: "But it is only a message now."
Urchin: "That is a better kind of message."
Whale: "We have learned from this."
Urchin: "We have written it down."
Whale: "In the runbook."
Urchin: "Yes."
CVE-2021-44228 ยท CVSS 10.0 Critical
Patch the thing that only logs things.
Sources
The joke only works if the vulnerability is real. These are the primary records.