57

Update 2021-12-21:

Mitigation for all Log4j-related 3 CVEs is complete on the following products:

  • Stackoverflow.com and related (public) websites
  • Stack Overflow Teams: Free, Basic and Business
  • Stack Overflow Teams: Enterprise: Hosted customers
  • Stack Overflow Teams: Enterprise: On-prem customers (Instructions have been sent to customer contacts)

Stack Overflow now considers mitigations for all 3 CVEs complete. Have a safe and happy holiday!


Update 2021-12-20:

  • CVE-2021-45046 (2nd CVE): We have determined that this is a low severity vulnerability. Severity aside, we are prioritizing the remediation of this vulnerability. We will update this post when mitigation is complete.
  • CVE-2021-45105 (3rd CVE): We have determined we are not vulnerable.

Announcement:

A vulnerability (CVE-2021-44228) impacting multiple versions of the Apache Log4j2 package was publicly disclosed on December 9, 2021. Stack Overflow’s products use ElasticSearch, which uses Log4j. We have determined that this is a low severity vulnerability based on the way we use ElasticSearch. Severity aside, we are prioritizing the remediation of this vulnerability.

Current status:

  • Remediation completed as of 2021-12-14 6pm ET
    • Stackoverflow.com and related (public) websites
    • Stack Overflow Teams: Free, Basic and Business
    • Stack Overflow Teams: Enterprise: Hosted customers
    • Stack Overflow Teams: Enterprise: On-prem customers
      • Instructions have been sent to customer contacts.

A further vulnerability (CVE-2021-45046) was disclosed on December 14th, 2021. Remediation plans are in progress.

9
  • 5
    @Luuklag do you think it should be? This is a very, very geeky thing and featured posts are shown to all sites of the network, most of which will have no interest in specific security vulnerabilities, especially since individual users won't be affected and there seems to be no large risk to SE user data here. Us geeks would probably be interested in this, but I don't think it makes sense to aggressively push it to all sites on the network. Remember that most people are not aware of the Log4j2 issue and will not understand the details anyway.
    – terdon
    Dec 15, 2021 at 15:29
  • 2
    @terdon it has been national news on a few days here, so I think most people know in a way what this is about, and will be assured by the fact that their data here isn't at jeopardy.
    – Luuklag
    Dec 15, 2021 at 15:30
  • 2
    @Luuklag I thought so too back with the heartbleed bash issue which also made national news and yet the vast majority of people around me had not heard of it. If people start asking, I guess we can request for it to be featured, but if not, I would vote for leaving it unfeatured since there are only 2 slots for featured posts and both are currently used by more important (to the network) things.
    – terdon
    Dec 15, 2021 at 15:32
  • @terdon, no there are 3 slots available these days.
    – Luuklag
    Dec 15, 2021 at 15:36
  • 1
    @Luuklag checking both MSO and MSE, I think this is the first meta post that's about both SE and Log4j, meaning that no one cares enough to ask... Dec 15, 2021 at 15:44
  • 18
    After some internal discussion, @Luuklag We're not going to feature this. While this is important and we want to be transparent about it, the severity of this is low and it's likely not information that is particularly important to bring to the attention of everyone - I'm also the keeper of the Featured tag and I know that there's some upcoming posts that will be significantly more important to the network and so we simply don't have space. When those two things combine, we've opted to leave it unfeatured. :)
    – Catija
    Dec 15, 2021 at 15:45
  • 1
    Thanks for putting forth your reasoning @Catija
    – Luuklag
    Dec 15, 2021 at 15:48
  • 9
    @RobertColumbia The announcement tag is specifically used to make announcements about the platform. We do this regularly. A question is not needed in these cases.
    – Catija
    Dec 15, 2021 at 15:53
  • 1
    @Catija - So those events don't combine into some weird coding Voltron? We totally need a coding Voltron emoticon....
    – Ramhound
    Dec 15, 2021 at 16:14

0

You must log in to answer this question.

Browse other questions tagged .