Example Advisory
Example stack
Monthly report, December 2021.
Period 1 Dec 2021 to 31 Dec 2021. Prepared 3 Jan 2022.
Products watched
| Product | Version | Watched since |
|---|---|---|
| Apache Log4j2 | 2.14.1 | 1 Nov 2021 |
| OpenSSL | 3.0.13 | 1 Nov 2021 |
| nginx | 1.24.0 | 1 Nov 2021 |
Alerts raised in December 2021
| Date | CVE | What changed | Class | Version verdict | Source |
|---|---|---|---|---|---|
| 10 Dec 2021 | CVE-2021-44228 | CVE-2021-44228 entered CISA KEV, with a remediation deadline of 2021-12-24. | material | affected 2.14.1 is inside an affected range this record publishes for apache log4j: >= 2.13.0, < 2.15.0. Your watched version 2.14.1 is inside an affected range this record publishes for apache log4j: >= 2.13.0, < 2.15.0. | CISA KEV |
Decisions recorded in December 2021
| Date | CVE | Decision | Record |
|---|---|---|---|
| 11 Dec 2021 | CVE-2021-44228 | patch by a date Advice given: Update Apache Log4j2 to the fixed release on every host that runs it, internet-facing hosts first. Until a host is updated, set log4j2.formatMsgNoLookups to true. Told Jordan Ellis on 11 Dec 2021. | Held by Example Advisory |
Still open with a CISA deadline
No CVE raised for this stack is open with a CISA deadline.
Evidence from vciy, prepared 3 Jan 2022Every line is dated and sourced.