The pervasiveness of the logging software has allowed the bug to have a ripple effect across tightly connected digital supply chains, cybersecurity experts say, leaving some companies rushing to take stock of their vendors’ tools and security measures. “If you exploit this kind of vulnerability, you could really harm companies and also ruin the reputation of the vendor,” Mr.
officials in recent days called on suppliers affected by the Log4j vulnerability to update their software and contact customers. agencies through a compromised SolarWinds Corp. The vulnerability poses the latest threat to the supply chains that help the digital economy run, already under scrutiny from companies and governments since Russian hackers allegedly breached U.S. “It’s quite likely we won’t see any concerted patching efforts till the new year.” “But let’s look at the calendar, what’s happening in two weeks? Christmas,” he said. It could take many tech vendors a week or two to patch software affected by the vulnerability, Mr. Developers sometimes build software atop existing tools without fully understanding the underlying code, he said, potentially obscuring flaws such as the Log4j vulnerability.
The Log4j framework is used in at least 250,000 open-source software projects cataloged by Fortress Information Security, which analyzes suppliers to critical-infrastructure businesses including power companies and defense contractors, said
0 kommentar(er)
