The example stack is named "Example stack" and watches Apache Log4j2 2.14.1. The change is CISA adding CVE-2021-44228 to its Known Exploited Vulnerabilities catalogue. The stack's repository, acme/billing, is attached, so the alert also says where the package sits in it.
CVE-2021-44228 entered CISA KEV, with a remediation deadline of 2021-12-24. Your watched version 2.14.1 is inside an affected range this record publishes for apache log4j: >= 2.13.0, < 2.15.0.
Shared from a vciy alert on Apache Log4j2. This page is read-only.
What changed
Matched by product name. Your watched version 2.14.1 is affected: 2.14.1 is inside an affected range this record publishes for apache log4j: >= 2.13.0, < 2.15.0.
The fix and CISA's required action from the record and CISA
Show full CISA required action
For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.
In your repository
Read from acme/billing when this alert was raised. 2 pinned versions in it are affected. Unknown means the file does not settle the version.
org.apache.logging.log4j:log4j-core
services/billing/gradle.lockfile2.14.1affectedfixed in2.15.0GHSA-jfh8-c2jp-5v3qservices/payments/gradle.lockfile2.14.1affectedfixed in2.15.0GHSA-jfh8-c2jp-5v3qtools/legacy/pom.xml2.17.1unknownNot cleared: this file states a version the build tool may resolve differently.services/web/gradle.lockfile2.17.1not-affected
For your ticket
CVE-2021-44228 (Log4Shell): network-reachable · no privileges required · no user interaction · low attack complexity, complete confidentiality, integrity and availability loss, with impact beyond the vulnerable component. Exploited in the wild · CISA KEV listed, 2021-12-10. Ransomware campaign use is known to CISA. Fixed in 2.3.1; 2.12.2; 2.15.0. KEV required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available, was due 2021-12-24. In acme/billing, log4j-core 2.14.1 is affected in services/billing/gradle.lockfile and 1 other place. Fixed in 2.15.0 for that file. Source: https://vciy.com/cve/CVE-2021-44228.
The same paragraph the public CVE page offers. Every clause is a value that page shows, and a value the index does not hold is left out.
The proof link
Every alert carries a proof link beside the ticket paragraph. It opens this sitrep read-only, with no account, so a colleague can check the evidence.
As the email reads
The message a Community stack receives for this change, from the same code that sends it.
Subject: vciy: 1 public-evidence change
vciy: 1 public-evidence change
Now: 2021-12-10
You watch Apache Log4j2 in Example stack.
In acme/billing: log4j-core 2.14.1 in services/billing/gradle.lockfile, affected, fixed in 2.15.0. +1 more.
For your ticket
CVE-2021-44228 (Log4Shell): network-reachable · no privileges required · no user interaction · low attack complexity, complete confidentiality, integrity and availability loss, with impact beyond the vulnerable component. Exploited in the wild · CISA KEV listed, 2021-12-10. Ransomware campaign use is known to CISA. Fixed in 2.3.1; 2.12.2; 2.15.0. KEV required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available, was due 2021-12-24. In acme/billing, log4j-core 2.14.1 is affected in services/billing/gradle.lockfile and 1 other place. Fixed in 2.15.0 for that file. Source: https://vciy.com/cve/CVE-2021-44228.
View evidenceProduct-name matches. Each watched version was then checked against the ranges its record publishes.
As the Slack message reads
The text a Practitioner stack posts to Slack, shown as the plain message text.
*vciy: 1 public-evidence change* *CVE-2021-44228 entered CISA KEV, with a remediation deadline of 2021-12-24. Your watched version 2.14.1 is inside an affected range this record publishes for apache log4j: >= 2.13.0, < 2.15.0.* Now: 2021-12-10 You watch Apache Log4j2 in Example stack. In acme/billing: log4j-core 2.14.1 in services/billing/gradle.lockfile, affected, fixed in 2.15.0. +1 more. For your ticket: ```CVE-2021-44228 (Log4Shell): network-reachable · no privileges required · no user interaction · low attack complexity, complete confidentiality, integrity and availability loss, with impact beyond the vulnerable component. Exploited in the wild · CISA KEV listed, 2021-12-10. Ransomware campaign use is known to CISA. Fixed in 2.3.1; 2.12.2; 2.15.0. KEV required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available, was due 2021-12-24. In acme/billing, log4j-core 2.14.1 is affected in services/billing/gradle.lockfile and 1 other place. Fixed in 2.15.0 for that file. Source: https://vciy.com/cve/CVE-2021-44228.``` <https://app.vciy.com/sitrep/specimen-log4shell-kev/838a7651b6ef039b5169d961ea179226752d31a06e7743dd9a94a467a2cd5d55|View evidence> Product-name matches. Each watched version was then checked against the ranges its record publishes. Manage or mute notifications in vciy.