Here’s an in-depth breakdown of what we know so far with the log4j vulnerability and information about Greenbone’s feed coverage, including questions that have come up with our clients and community.
Update from 2021-12-20: vulnerability tests for products running on Microsoft Windows are now available.
Note: The tests check the existence of log4j and its version. A separate vulnerability test may not be available for each affected application, but all log4j files are found and reported (
/path-to-log4j-file/).The issued installation paths must be checked and, if necessary, the vendor must be contacted. It must be checked whether updates are already available for the respective application and whether the find is relevant.
PowerShell execution privileges on a target system are required for the account used in an authenticated scan. Some vulnerability tests execute PowerShell commands to increase the accuracy of the results, which require permissions for the duration of a scan.
We are continuously adding more VTs. To get the most current information regarding your installation, you can search for ~CVE-2021-44228 in the “CVE” and “NVTs” section of the “SecInfo” menu on the web interface of your installation.
Questions or comments? Please join us here in the discussion. Thanks!