{"id":764,"date":"2021-12-13T11:13:59","date_gmt":"2021-12-13T11:13:59","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/kriticno-upozorenje-zero-day-ranjivost-ili-ranjivost-nultog-dana-u-java-biblioteci-log4j\/"},"modified":"2026-11-04T08:46:49","modified_gmt":"2026-11-04T08:46:49","slug":"kriticno-upozorenje-zero-day-ranjivost-ili-ranjivost-nultog-dana-u-java-biblioteci-log4j","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/ranjivosti\/kriticno-upozorenje-zero-day-ranjivost-ili-ranjivost-nultog-dana-u-java-biblioteci-log4j\/","title":{"rendered":"Kriti\u010dno upozorenje Zero-Day ranjivost ili ranjivost nultog dana u Java biblioteci Log4j"},"content":{"rendered":"<p class=\"wp-block-paragraph\">U petak 10.12.2021. Nacionalni CERT je zaprimio obavijest o otkrivanju kriti\u010dne ranjivosti <a href=\"https:\/\/epsilon.cert.hr\/cve\/CVE-2021-44228\">CVE-&nbsp;2021-44228<\/a> u Java logging programskoj biblioteci Log4j. Otkrivena ranjivost potencijalnom udaljenom napada\u010du omogu\u0107ava izvr\u0161avanje proizvoljnog programskog koda u sustavu (engl. <em><strong>remote code execution - RCE<\/strong><\/em>) ili kra\u0111u osjetljivih informacija. <em>Proof-of-concept<\/em> (PoC) koda koji iskori\u0161tava ranjivost ve\u0107 je dostupan javnosti. Radi se o popularnoj softverskoj biblioteci koju koristi <strong>veliki broj<\/strong> Java aplikacija, a ranjivi su poslu\u017eiteljske aplikacije i klijenti. Posebno isti\u010demo da ranjive mogu biti i aplikacije koje nisu javno dostupne, ali obra\u0111uju podatke iz drugih, javno dostupnih sustava (npr. <em>Elasticsearch <\/em>koji je dio ELK infrastrukture za pohranu i pretra\u017eivanje velike koli\u010dine podataka).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nacionalni CERT poslao je upozorenje i upute CARNET ustanovama \u010dlanicama u kojima savjetuje svim administratorima poduzimanje hitnih mjera i pra\u0107enje statusa ranjivosti.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Ranjive su verzije Apache Log4j od 2.0-beta9 do 2.14.1.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span class=\"has-inline-color has-vivid-red-color\"><a href=\"https:\/\/twitter.com\/marcioalm\/status\/1470361495405875200\" target=\"_blank\" rel=\"noreferrer noopener\"><span style=\"text-decoration: underline;\">Na temelju novih saznanja<\/span><\/a>, JNDI-Exploit-Kit prolazi u <strong>*bilo kojoj verziji Jave*<\/strong>, dok god se klase u <em>serialized payloadu <\/em>nalaze u aplikacijskom <em>classpathu. <\/em>Neovisno o a\u017euriranjima Jave, potrebno je a\u017eurirati log4j biblioteku \u0161to je prije mogu\u0107e! <\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><s>Na temelju trenutno dostupnih saznanja, u zadanoj konfiguraciji JDK verzija ve\u0107ih od 6u211, 7u201, 8u191 i 11.0.1 parametar je onemogu\u0107en com.sun.jndi.ldap.object.trustURLCodebase, \u0161to zna\u010di da se RCE napad ne mo\u017ee izvesti putem JNDI-LDAP vektora, ali se mogu izvr\u0161iti napadi s ciljem kra\u0111e osjetljivih podataka. No, postoji mogu\u0107nost iskori\u0161tavanja ranjivosti putem drugih vektora (npr. JNDI-RMI).<\/s><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Informacije o ovoj kriti\u010dnoj ranjivosti objavile su i hrvatske tvrtke koje se bave kiberneti\u010dkom sigurnosti <strong><a href=\"https:\/\/www.infigo.hr\/hr\/insights\/29\/log4shell-kriticna-zero-day-ranjivost-za-popularni-log4j-library\/\">Infigo IS<\/a> <\/strong>i <a href=\"https:\/\/github.com\/Diverto\/nse-log4shell\"><strong>Diverto<\/strong><\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.zsis.hr\/default.aspx?id=448\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>CERT Zavoda za sigurnost informacijskih sustava (ZSIS)<\/strong><\/a> nagla\u0161ava<strong> <\/strong>kako je ranjivost pod nazivom <strong>Log4Shell<\/strong> dobila CVSS ocjenu 10,0 zbog nekoliko \u010dimbenika:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>ranjivost je<strong> lako iskoristiva<\/strong> \u2013 napada\u010du je potrebna samo mogu\u0107nost kontrole <em>stringova<\/em> koji \u0107e se zabilje\u017eiti putem log4j biblioteke<\/li><li>zbog velikog broja <strong>razli\u010ditih vektora<\/strong> za potencijalni napad (mnogo razli\u010ditih operacija se bilje\u017ei i kontrolira od strane napada\u010da) jedini cjeloviti na\u010din uklanjanja ranjivosti je nadogradnja na najnoviju ina\u010dicu<\/li><li>veliki <strong>broj komponenti i tehnologija<\/strong> koristi log4j<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Mitigacija<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Dostupna je nova ina\u010dica biblioteke&nbsp;<a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/download.html\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>2.17.0<\/strong><\/a>&nbsp;u kojoj su aktualne ranjivosti uklonjene.&nbsp;Ranjivost <a href=\"https:\/\/epsilon.cert.hr\/cve\/CVE-2021-44228\">CVE-&nbsp;2021-44228<\/a> se ve\u0107 iskori\u0161tava u razli\u010ditim kiberneti\u010dkim napadima.&nbsp;<strong>Preporu\u010dujemo da svi administratori sustava poduzmu hitne mjere<\/strong>.<\/p>\n\n\n\n<ol class=\"wp-block-list\" type=\"1\"><li>Instaliranje <strong>najnovije ina\u010dice - <a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/download.html\" target=\"_blank\" rel=\"noreferrer noopener\" title=\"https:\/\/logging.apache.org\/log4j\/2.x\/download.html\">2.17.0<\/a><\/strong> u kojoj su sve aktualne ranjivosti uklonjene.<\/li><li><s><span class=\"has-inline-color has-vivid-red-color\">U slu\u010daju verzije &gt;= 2.10.0, <strong>onemogu\u0107avanje slanja zahtjeva<\/strong> Log4j biblioteci:<br><code>-Dlog4j2.formatMsgNoLookups=true<\/code><\/span><\/s> <ul><li><strong>Iz <a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/security.html#CVE-2021-45046\" target=\"_blank\" rel=\"noreferrer noopener\">Apachea navode<\/a> da ova mjera nije dovoljna za za\u0161titu.<\/strong><\/li><\/ul><\/li><li><strong>Primjena <\/strong>zadnjih dostupnih<strong> a\u017euriranja <\/strong>tehnologija koje koriste Log4j<\/li><li><strong>Blokiranje <\/strong>potencijalno zlonamjernih zahtjeva <a href=\"https:\/\/www.zsis.hr\/default.aspx?id=448\" target=\"_blank\" rel=\"noreferrer noopener\">na WAF-u<\/a><\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Ostale mogu\u0107nosti ubla\u017eavanja ranjivosti nalaze se na slu\u017ebenim stranicama <a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/security.html\">Apache<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><span class=\"has-inline-color has-vivid-red-color\">UPDATE<\/span><\/strong> (14\/12\/2021)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nacionalni CERT je u suradnji s <strong>Laboratorijem za sustave i signale<\/strong> Fakulteta elektrotehnike i ra\u010dunarstva izradio <a href=\"https:\/\/cert.hr\/en\/log4j-upute-za-otkrivanje-ranjivih-servisa\/\" target=\"_blank\" rel=\"noreferrer noopener\">upute za detekciju<\/a> i otkrivanje ranjivih servisa te pretragu sustava kako bi se utvrdilo je li na sustavu iskori\u0161tena ranjivost u biblioteci log4j za sistem administratore. Upute mo\u017eete preuzeti <a href=\"\/wp-content\/uploads\/2021\/12\/upute_detekcija_log4j.pdf\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>ovdje.<\/strong><\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><span class=\"has-inline-color has-vivid-red-color\">UPDATE<\/span><\/strong> (14\/12\/2021)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dostupna je nova ina\u010dica log4j biblioteke <strong><a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/changes-report.html#a2.16.0\" target=\"_blank\" rel=\"noreferrer noopener\">2.16.0<\/a><\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>po <em>defaultu<\/em> onemogu\u0107en JNDI. Potrebno je postaviti log4j2.enableJndi na \"true\" kako bi dopustili JNDI. <ul><li>Ispravlja <a href=\"https:\/\/issues.apache.org\/jira\/browse\/LOG4J2-3208\" target=\"_blank\" rel=\"noreferrer noopener\">LOG4J2-3208<\/a><\/li><\/ul><\/li><li>potpuno uklonjen <em>support <\/em>za <em>Message Lookups. <\/em><ul><li>Ispravlja <a href=\"https:\/\/issues.apache.org\/jira\/browse\/LOG4J2-3211\" target=\"_blank\" rel=\"noreferrer noopener\">LOG4J2-3211<\/a><\/li><\/ul><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Otkrivena je dodatna ranjivost log4j biblioteke pod oznakom <a href=\"https:\/\/epsilon.cert.hr\/cve\/CVE-2021-45046\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2021-45046<\/a> koja uzrokuje <strong>uskra\u0107ivanje dostupnosti (eng. <em>Denial-of-Service<\/em>).<\/strong> Preporu\u010duje se a\u017euriranje na<strong> ina\u010dicu 2.16.0.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span class=\"has-inline-color has-vivid-red-color\"><strong>UPDATE<\/strong> <\/span>(17\/12\/2021)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Otkriveno je da je ranjivosti<span class=\"has-inline-color has-vivid-red-color\"> <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-45046\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>CVE-2021-45046<\/strong><\/a><\/span> ocjena narasla iz 3,7 u 9,0 CVSS te je u\u0161la me\u0111u kriti\u010dne ranjivosti biblioteke log4j, a mo\u017ee uzrokovati <strong>RCE napad<\/strong> (eng. <em>Remote Code Execution<\/em>). Ina\u010dice log4j biblioteke na koje se odnosi ranjivost su od <a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/security.html\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>2.0-beta9 to 2.15.0<\/strong>.<\/a> Hitno se preporu\u010duje a\u017euriranje na 2.16.0. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span class=\"has-inline-color has-vivid-red-color\"><strong>UPDATE<\/strong> <\/span>(18\/12\/2021)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dostupna je nova ina\u010dica log4j biblioteke <strong><a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/download.html\" target=\"_blank\" rel=\"noreferrer noopener\">2.17.0<\/a><\/strong>.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>ispravlja ranjivost <a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-45105\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2021-45105<\/a> koja potencijalno uzrokuje uskra\u0107ivanje dostupnosti (7,5 CVSS)<\/li><li>ispravlja <a href=\"https:\/\/issues.apache.org\/jira\/browse\/LOG4J2-3230\" target=\"_blank\" rel=\"noreferrer noopener\">LOG4J2-3230<\/a><\/li><li><a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/security.html\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/logging.apache.org\/log4j\/2.x\/security.html<\/a><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Otkriven je <a href=\"https:\/\/www.blumira.com\/analysis-log4shell-local-trigger\/\" target=\"_blank\" rel=\"noreferrer noopener\">alternativni vektor napada<\/a> koji iskori\u0161tava ranjivosti u log4j biblioteci. Novi vektor napada se oslanja na povezivanje <em><strong>Javascriptovog Websocketa<\/strong><\/em> kako bi aktivirao RCE na izlo\u017eenim internim ili lokalnim nea\u017euriranim log4j aplikacijama. Drugim rije\u010dima, bilo tko s ranjivom ina\u010dicom biblioteke na svojem stroju ili lokalnoj privatnoj mre\u017ei mo\u017ee potencijalno aktivirati iskori\u0161tavanje ranjivosti.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span class=\"has-inline-color has-vivid-red-color\"><strong>UPDATE<\/strong> <\/span>(29\/12\/2021)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Otkrivena je nova ranjivost log4j biblioteke pod oznakom <a href=\"https:\/\/epsilon.cert.hr\/cve\/CVE-2021-44832\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2021-44832<\/a>, koja omogu\u0107ava udaljenom napada\u010du <a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/security.html\" target=\"_blank\" rel=\"noreferrer noopener\">izvr\u0161avanje programskog k\u00f4da<\/a>, a ima CVSS ocjenu 6.6. <strong>Preporu\u010duje se a\u017euriranje na <a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/download.html\" target=\"_blank\" rel=\"noreferrer noopener\">najnoviju ina\u010dicu 2.17.1.<\/a><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Trenutna lista zahva\u0107enih tehnologija (puni opseg utjecaja ranjivosti se jo\u0161 utvr\u0111uje i nadopunjava): <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/gist.github.com\/SwitHak\/b66db3a06c2955a9cb71a8718970c592\">https:\/\/gist.github.com\/SwitHak\/b66db3a06c2955a9cb71a8718970c592<\/a><\/li><li><a href=\"https:\/\/github.com\/YfryTchsGD\/Log4jAttackSurface\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/github.com\/YfryTchsGD\/Log4jAttackSurface<\/a><\/li><li><a href=\"https:\/\/mvnrepository.com\/artifact\/log4j\/log4j\/usages\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/mvnrepository.com\/artifact\/log4j\/log4j\/usages<\/a><\/li><li><a href=\"https:\/\/github.com\/cisagov\/log4j-affected-db\/blob\/develop\/SOFTWARE-LIST.md\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/github.com\/cisagov\/log4j-affected-db\/blob\/develop\/SOFTWARE-LIST.md<\/a><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Vi\u0161e o samoj ranjivosti mo\u017eete pro\u010ditati na poveznicama:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/security.html#CVE-2021-45046\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/logging.apache.org\/log4j\/2.x\/security.html<\/a><\/li><li><a href=\"https:\/\/www.lunasec.io\/docs\/blog\/log4j-zero-day\/\">https:\/\/www.lunasec.io\/docs\/blog\/log4j-zero-day\/<\/a><\/li><li><a href=\"https:\/\/www.cyberkendra.com\/2021\/12\/worst-log4j-rce-zeroday-dropped-on.html\">https:\/\/www.cyberkendra.com\/2021\/12\/worst-log4j-rce-zeroday-dropped-on.html<\/a><\/li><li><a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/logging.html\">https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/current\/logging.html<\/a><\/li><li><a href=\"https:\/\/www.govcert.ch\/blog\/zero-day-exploit-targeting-popular-java-library-log4j\/\">https:\/\/www.govcert.ch\/blog\/zero-day-exploit-targeting-popular-java-library-log4j\/<\/a> <a href=\"https:\/\/logging.apache.org\/log4j\/2.x\/security.html\">https:\/\/logging.apache.org\/log4j\/2.x\/security.html<\/a><\/li><li><a href=\"https:\/\/tools.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-apache-log4j-qRuKNEbd\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/tools.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-apache-log4j-qRuKNEbd<\/a><\/li><li><a href=\"https:\/\/psirt.global.sonicwall.com\/vuln-detail\/SNWLID-2021-0032\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/psirt.global.sonicwall.com\/vuln-detail\/SNWLID-2021-0032<\/a><\/li><li><a href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/12\/11\/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.microsoft.com\/security\/blog\/2021\/12\/11\/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation\/<\/a><\/li><li><a href=\"https:\/\/github.com\/NCSC-NL\/log4shell\" rel=\"noreferrer noopener\" target=\"_blank\">https:\/\/github.com\/NCSC-NL\/log4shell<\/a> <\/li><li><a href=\"https:\/\/github.com\/enisaeu\/CNW\/tree\/main\/log4shell\" rel=\"noreferrer noopener\" target=\"_blank\">https:\/\/github.com\/enisaeu\/CNW\/tree\/main\/log4shell<\/a><\/li><li><a href=\"https:\/\/github.com\/Diverto\/nse-log4shell\" target=\"_blank\" rel=\"noreferrer noopener\" title=\"https:\/\/github.com\/Diverto\/nse-log4shell\">https:\/\/github.com\/Diverto\/nse-log4shell<\/a> <\/li><li><a href=\"https:\/\/www.infigo.hr\/hr\/insights\/29\/log4shell-kriticna-zero-day-ranjivost-za-popularni-log4j-library\/\" target=\"_blank\" rel=\"noreferrer noopener\" title=\"https:\/\/www.infigo.hr\/hr\/insights\/29\/log4shell-kriticna-zero-day-ranjivost-za-popularni-log4j-library\/\">https:\/\/www.infigo.hr\/hr\/insights\/29\/log4shell-kriticna-zero-day-ranjivost-za-popularni-log4j-library\/<\/a><\/li><li><a href=\"https:\/\/www.zsis.hr\/default.aspx?id=448\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.zsis.hr\/default.aspx?id=448<\/a><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Shema log4j JNDI napada (izvor: <a href=\"https:\/\/www.govcert.ch\/blog\/zero-day-exploit-targeting-popular-java-library-log4j\/\" target=\"_blank\" rel=\"noreferrer noopener\">govcert.ch<\/a>)<\/strong><\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6af19eb813290&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6af19eb813290\" class=\"wp-block-image size-large wp-lightbox-container\"><img decoding=\"async\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"\/wp-content\/uploads\/2021\/12\/log4j_attack-1024x692.jpg\" alt=\"\" class=\"wp-image-109657\"\/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Trenutno <strong>Nacionalni CERT nije zaprimio prijavu u vezi uspje\u0161nog iskori\u0161tavanja ranjivosti u hrvatskom kiberneti\u010dkom prostoru<\/strong>. Nacionalni CERT \u0107e i dalje izvje\u0161tavati hrvatsku javnost ovisno o novim informacijama i procjeni ugro\u017eenosti hrvatskog kiberneti\u010dkog prostora.<\/p>","protected":false},"excerpt":{"rendered":"<p>U petak 10.12.2021. Nacionalni CERT je zaprimio obavijest o otkrivanju kriti\u010dne ranjivosti CVE-&nbsp;2021-44228 u Java logging programskoj biblioteci Log4j. Otkrivena ranjivost potencijalnom udaljenom napada\u010du omogu\u0107ava izvr\u0161avanje proizvoljnog programskog koda u sustavu (engl. remote code execution &#8211; RCE) ili kra\u0111u osjetljivih informacija. Proof-of-concept (PoC) koda koji iskori\u0161tava ranjivost ve\u0107 je dostupan javnosti. Radi se o popularnoj [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1192,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[27],"tags":[],"tema":[],"class_list":["post-764","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ranjivosti"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/764","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=764"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/764\/revisions"}],"predecessor-version":[{"id":1193,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/764\/revisions\/1193"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1192"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=764"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=764"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=764"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=764"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=764"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}