The Log4j Vulnerability: Patching and Mitigation

In this video walk-through, we covered how to patch and mitigate the Log4j vulnerability using Apache newly released guidelines. We used lab material from TryHackMe.
********
Receive Cyber Security Field Notes and Special Training Videos
********
Written Walk-through
******************
More resources on patching the log4j
********
Mitigation
LOG4J_FORMAT_MSG_NO_LOOKUPS
**********
Google Profile
LinkedIn
Instagram
Twitter
Facebook

[samirshaikh]

Thank you Motasem making informative video. This channel is so much underrated. Needs more subscribers and viewers.

[drakezen]

My understanding is that the version 2.16 is not sufficient as a solution as it allows for denial of service attacks, so 2.17 is the current recommendation. This video is very well explained and helpful, thanks!

[louisasdo]

​ Hi I am new in here, I have read your comment below but don't understand, what do you mean no delete but just copy and replace?
Say currently the application is using 2.14 core, and I copy the 2.17.1 core in the same folder, but don't delete the 2.14 core and keep it there?? And any configure do we need to adjust after replace the .jar files?

[jayrawani]

Hi, can u plz provide note on updating from 2.11.1 to 2.17.0 log4j for Linux elasticsearch

[UmairAli]

Thank for uploading this, really informative, just one question, I am very much curious and interested to know more about this I mean, If there's a Possibility that you could guide me where I could get the code of a web application that uses log4j's vulnerable version and patched one, it would be great cuz as a developer and pentester I would really wanna inspect if for understanding purposes .. and thanks again,

[private]

How to replace those files with new file if we have downloaded on same server
Can we do it at once

[ramenpradhan]

Can you please provide the notes or please tell me how to get the notes