{"id":11995,"date":"2021-12-16T18:01:00","date_gmt":"2021-12-16T16:01:00","guid":{"rendered":"https:\/\/www.thegreenbow.com\/societe\/actualites\/alerte-securite-log4shell-vpn-thegreenbow-ne-sont-pas-impactes\/"},"modified":"2022-01-04T10:51:43","modified_gmt":"2022-01-04T08:51:43","slug":"log4shell-security-notice-thegreenbow-vpns-not-affected","status":"publish","type":"post","link":"https:\/\/www.thegreenbow.com\/en\/company\/news\/log4shell-security-notice-thegreenbow-vpns-not-affected\/","title":{"rendered":"\u201cLog4Shell\u201d Security Notice: TheGreenBow VPNs are not affected"},"content":{"rendered":"\n
\n \n
\n\n

\u201cLog4Shell\u201d Security Notice: TheGreenBow VPNs are not affected<\/h1>\n \n <\/div>\n\n \n \n \n<\/section>\n\n\n
\n
\n
\n
\n \n

Initially spotted on November 24, by Alibaba Cloud\u2019s Security Team, the zero-day vulnerability CVE-2021-44228<\/a> was officially reported by the Apache Software Foundation on Thursday, December 9.<\/h3>\n <\/div>\n <\/div>\n <\/div>\n\n <\/section>\n\n
\n
\n
\n
\n \n
\"\"<\/figure>
\n

The vulnerability concerns the Log4J logging utility, an important software component that is very widespread in a great number of applications that use the Java language.<\/p>\n\n\n\n

As a cybersecurity software editor, TheGreenBow took immediate action to assess the impact of the recently discovered security breach on its products.<\/p>\n<\/div><\/div>\n <\/div>\n <\/div>\n <\/div>\n\n <\/section>\n\n

\n
\n
\n
\n \n

No impact on TheGreenBow products<\/strong><\/strong><\/h3>\n <\/div>\n <\/div>\n <\/div>\n\n <\/section>\n\n
\n
\n
\n
\n \n

Following the impact audit conducted on its products regarding vulnerability CVE-2021-44228<\/a><\/strong> (\u201cLog4Shell\u201d), TheGreenBow is now able to confirm that none of its products use the Log4j library. Therefore, we can safely say that this vulnerability does not apply to any of our products<\/u><\/strong> (VPN Clients and License Activation Server).<\/p>\n <\/div>\n <\/div>\n <\/div>\n\n <\/section>\n\n

\n
\n
\n
\n \n

<\/p>\n <\/div>\n <\/div>\n <\/div>\n\n <\/section>\n\n

\n
\n
\n
\n \n

What does this breach entail?<\/strong><\/strong><\/h3>\n <\/div>\n <\/div>\n <\/div>\n\n <\/section>\n\n
\n
\n
\n
\n \n

The security breach, named \u201cLog4Shell\u201d, is currently of great concern to CISOs, since it may be present in a great number of information systems hosting office automation software, servers, or embedded systems. Locating the issue and correcting it may therefore take quite some time.<\/p>\n <\/div>\n <\/div>\n <\/div>\n\n <\/section>\n\n

\n
\n
\n
\n \n

Attackers who exploit this vulnerability can execute arbitrary code on a server that uses the Log4j library. In worst case scenarios, an attacker may be able to take complete control of the server without needing to authenticate in view of gaining access to the network, stealing sensitive information, or even launching a denial-of-service attack.<\/p>\n <\/div>\n <\/div>\n <\/div>\n\n <\/section>\n\n

\n
\n
\n
\n \n

In its press release dated December 16, the French National Cybersecurity Agency (ANSSI) confirms that the Log4Shell vulnerability is being actively exploited. A race against the clock has thus begun to stay ahead of cybercriminals.<\/p>\n <\/div>\n <\/div>\n <\/div>\n\n <\/section>\n\n

\n
\n
\n
\n \n

To find out more about Log4Shell<\/strong><\/strong><\/h3>\n <\/div>\n <\/div>\n <\/div>\n\n <\/section>\n\n
\n
\n
\n
\n \n