Greetings Veracode Community Members, 

On Friday, a new zero-day vulnerability was discovered in Log4J, which is a Java logging framework from Apache. It has been added to our database as CVE-2021-44228. 

There are numerous reports of the vulnerability being actively exploited and it needs to be patched promptly. See more about the patched Log4j version. 

Our teams at Veracode have been working to provide you with all the latest guidance, instructions, and product offers to support you during this time. We will use this post to keep you updated the full set of resources available, so please check back frequently.  

------------------------ 

Resource Overview 

Veracode has created several resources so far to help people to understand the impact of the vulnerability and steps needed to remediate where necessary.  

These resources currently include:  

• A blog article on Veracode.com with a detailed analysis of the situation. This blog post will continue to be updated with the latest information from our Veracode Research Team as it unfolds.  
• A livestream by our founder and CTO, Chris Wysopal, and Principal Strategic Researcher, Giuseppe Trovato, providing further insights as well as answering questions posed by the audience. 
• Instructions on how to use Veracode Software Composition Analysis (SCA) Scanning to determine whether your apps are impacted by the Log4j zero-day vulnerability. We have attached that guidance to the bottom of this post and you can also find it linked here.

Veracode Software Composition Analysis (SCA) Product Access 

We realize the urgent nature of this vulnerability and the need to do whatever we can to support our customers during this time.  Since this vulnerability is categorized with a CVSS score of 9.8 and requires urgent action, we are extending you a courtesy license of our SCA product  for 10 days for current Veracode customers who do not yet own our SCA product, but need quick access to assess your exposure. If you are an existing customer but do not have SCA, please contact your Veracode representative for more information on the courtesy license.

Veracode Community Office Hours 

As an extra service during this time, we will also be hosting several Log4j Vulnerability Office Hours sessions this week sponsored by our Veracode Customer Community. These will be live sessions hosted by Veracode experts from our Veracode Research Team and our Application Security Consultant team where you can hop on to discuss your questions. 

We are going to be hosting live office hours sessions as follows:

Veracode Customer Success Log4j Office Hours Zoom Webinar

Dec 15, 2021 03:00 PM Eastern Time (US and Canada)Please click the link below to join the webinar:

https://veracode.zoom.us/j/91651470738?pwd=cHRzM0JIajJUV3RHSmJkWUNpWWM3Zz09

Passcode: 432708

Or One tap mobile :

    US: +13017158592,,91651470738#,,,,*432708# or +13126266799,,91651470738#,,,,*432708#

Or Telephone:

    Dial(for higher quality, dial a number based on your current location):

        US: +1 301 715 8592 or +1 312 626 6799 or +1 929 436 2866 or +1 253 215 8782 or +1 346 248 7799 or +1 669 900 6833

Webinar ID: 916 5147 0738

Passcode: 432708

    International numbers available: https://veracode.zoom.us/u/absUTibF5i

Obtaining Additional Assistance & Guidance  

As always, please feel free to reach out directly to your assigned Veracode Customer Success Manager or our Veracode support team for general support by emailing support@veracode.com.  

Additionally, for customers, don’t forget that you are able to book a consultation call directly with a Veracode Application Security Consultant regarding code remediation.