Second Log4j Vulnerability (CVE-2021-45046) Discovered

[HeikoAnkenbrand]

Is there any more detailed information from Check Point on this vulnerability yet?

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046

[_Val_]

I will ask the relevant team to comment, but from looking at the description, my guess is, we are not vulnerable. We do not use that library, as before.

[ClonyShen]

Is there an IPS Signatures  (CVE-2021-45046) in the Check Point ?

[Ataaf]

Do we have checkpoint IPS signature for CVE-2021-45046. if not, when will it be released?

[_Val_ · Accepted solution]

@ClonyShen, @Ataaf, @Peggy_Lee There is protection available now: https://www.checkpoint.com/defense/advisories/public/2021/cpai-2021-0936.html

[_Val_ · Accepted solution]

Thanks for your patience. Here is the official answer:

1. We are not vulnerable to CVE-2021-45046.
2. Threat Prevention signatures are now available: https://www.checkpoint.com/defense/advisories/public/2021/cpai-2021-0936.html

[Peggy_Lee]

May I ask if there is an eta for the signature?  Thanks 

[Andreas_Hofmann]

Hi,

did Checkpoint test vulnerability for LOM Modules which use Java?

Thanks AH

[_Val_]

Yes, not vulnerable.