Okta continues to monitor and enhance our detection capabilities as new methods of exploitation arise. The Okta Security team will continue to provide updates as necessary in this document. Zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class Remove the JndiLookup class from the classpath.Set the system property log4j2.formatMsgNoLookups to true, or.Deploy a WAF with rules specific to the exploitation observed around this vulnerability.We also recommend customers check whether any other (non-Okta) software they are running may be impacted and check in with applicable vendors for available patches.Ĭustomers unable to patch affected software should also consider the mitigation strategies outlined below. Okta People Picker for Sharepoint (2010, 2013, 2016).Okta MFA Credential Provider for Windows.The following products and components are NOT impacted by this issue: We strongly recommend customers apply the following updates to customer agents, available from within the Okta Admin Console:
Okta took prompt action to patch and mitigate the potential impact of this vulnerability on the Okta Identity service. This page will be updated over the coming days as more information becomes available. If exploited, it could potentially allow a remote attacker to execute code on the server if the system logs an attacker-controlled string value on an affected endpoint.Īs soon as Okta learned of this vulnerability, we promptly evaluated all cloud-hosted systems and customer premise agents to determine what might be impacted and methodically set about remediating any exposure. The vulnerability was disclosed by the Apache Log4j project on Thursday, December 9, 2021. Log4j is a Java-based logging utility found in a wide number of software products.
The Okta Security team continues to investigate and evaluate the Log4j Java library remote code execution (RCE) vulnerability (CVE-2021-44228), also known as Log4Shell.
0 kommentar(er)
