Deployment of preventive counter-measure for Log4j CVE(s)

Incident Report for enRoute SaaS

Resolved

We quickly assessed that enRoute's infrastructure components couldn't be impacted by the Log4j v2 CVE(s).

This monday 20:30 UTC, we adopted preventive counter-measures nonetheless, on the single internal Java component present in our infrastructure. The deployment of counter-measures had no impact on service availability.

Our security tools helped us analysing the CVE-2021-4104 potential on Log4j v1 component. It is confirmed that the impact is null in our context.

Our team is monitoring all infrastructure logs since Friday December 10, to confirm early security assessment.

Posted Dec 13, 2021 - 20:30 UTC