Company
Date Published
Author
Jill Moné-Corallo
Word count
749
Language
English
Hacker News points
None

Summary

GitHub has released new versions of GitHub Enterprise Server to update their Log4j dependency to version 2.17.1 as part of their normal release cycle, following initial mitigations for vulnerabilities such as CVE-2021-44228, CVE-2021-45046, and others. This update aims to decrease false positives from file-based vulnerability scanners. GitHub's security team has been actively monitoring and analyzing the impact of these vulnerabilities, particularly CVE-2021-44228, across their products and infrastructure and has not identified any additional risks or successful exploitations. The Enterprise Server is only exposed to the Log4j vulnerabilities in authenticated environments, and users are encouraged to upgrade to versions 3.3.1, 3.2.6, 3.1.14, or 3.0.22 or apply a hotpatch to mitigate risks. GitHub.com and GitHub Enterprise Cloud have also implemented mitigations, and no user action is required currently for these services. GitHub remains vigilant in monitoring for any new developments related to this vulnerability.