CISA alerts public to second severe Apache Log4j vulnerability

Apache has released a security update to address a second severe vulnerability affecting its Log4j software library, which a remote attacker could exploit to cause a denial-of-service condition, the Cybersecurity and Infrastructure Security Agency announced. Affected organizations that have already upgraded to Log4j 2.15.0 will need to upgrade to Log4j 2.16.0 to protect against both vulnerabilities. Log4j is broadly used in a variety of consumer and enterprise services, websites, applications and operational technology products to log security and performance information. 

John Riggi, AHA senior advisor for cybersecurity and risk, said, “It is noted that this second vulnerability could cause a ‘denial-of-service’ condition. A cyberattack that interrupts or shuts down mission-critical medical technology could cause delays in health care delivery and risk patient safety. Thus, we strongly advise the field to expeditiously implement this second patch, and we urge the government to take immediate countermeasures against any cyber actor and their infrastructure identified as attempting to exploit these vulnerabilities.” 

For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org.