Difference between revisions of "Log4j"
| Line 20: | Line 20: | ||
'''Frequently Asked Questions (Updated December 14, 2021 - 11:45 CET)''' | '''Frequently Asked Questions (Updated December 14, 2021 - 11:45 CET)''' | ||
<ul> | <ul> | ||
<li><em>Are Fundsquare products affected by the Log4j vulnerability? Which Products were affected? </em>The moment we received an alert, our security team immediately took the necessary action to analyse the impact of this finding over our organization and solutions. Patching of potentially impacted components has started and we follow the guidelines of experts to mitigate the risk and vulnerability caused by this security issue.</li> | <li><em>Are Fundsquare products affected by the Log4j vulnerability? Which Products were affected?<br /></em>The moment we received an alert, our security team immediately took the necessary action to analyse the impact of this finding over our organization and solutions. Patching of potentially impacted components has started and we follow the guidelines of experts to mitigate the risk and vulnerability caused by this security issue.</li> | ||
<li><em>What remediation actions have been taken? </em>All Fundsquare products, software and infrastructure are being evaluated and countermeasures have been or are going to be implemented for protection.</li> | <li><em>What remediation actions have been taken?<br /></em>All Fundsquare products, software and infrastructure are being evaluated and countermeasures have been or are going to be implemented for protection.</li> | ||
<li><em>Will this incident impact or interrupt the delivery of Fundsquare products and services? </em>At this time, we are not anticipating any service disruptions for any Fundsquare products or services.</li> | <li><em>Will this incident impact or interrupt the delivery of Fundsquare products and services?<br /></em>At this time, we are not anticipating any service disruptions for any Fundsquare products or services.</li> | ||
<li><em>What is the impact to Fundsquare’s business? </em>There is no impact to Fundsquare’s business at this time.</li> | <li><em>What is the impact to Fundsquare’s business?<br /></em>There is no impact to Fundsquare’s business at this time.</li> | ||
<li><em>How does Fundsquare protect its environment from potentially affected software? </em>Generally, Fundsquare does not disclose the details of its Cyber Security program. In response to this vulnerability, Fundsquare has followed the recommendations from Apache and local Cybersecurity and Infrastructure Agencies. These actions also include patching and increased monitoring. Our security team and partners work hard to protect Fundsquare.</li> | <li><em>How does Fundsquare protect its environment from potentially affected software?<br /></em>Generally, Fundsquare does not disclose the details of its Cyber Security program. In response to this vulnerability, Fundsquare has followed the recommendations from Apache and local Cybersecurity and Infrastructure Agencies. These actions also include patching and increased monitoring. Our security team and partners work hard to protect Fundsquare.</li> | ||
<li><em>Is an update of e-file.lu and its components required? </em>The advantage of e-file.lu is its deployment online through our website. In case of a required update due to a patch, we can manage this update from our back end and the next time you load the page, the patched version will be loaded. This would also be the case for the transmission module that constantly checks for updates when you launch it. A separate information would be issued in case of a necessary update of the sending service that may run locally at our clients. At this moment of the release of this information, no update is scheduled.</li> | <li><em>Is an update of e-file.lu and its components required?<br /></em>The advantage of e-file.lu is its deployment online through our website. In case of a required update due to a patch, we can manage this update from our back end and the next time you load the page, the patched version will be loaded. This would also be the case for the transmission module that constantly checks for updates when you launch it. A separate information would be issued in case of a necessary update of the sending service that may run locally at our clients. At this moment of the release of this information, no update is scheduled.</li> | ||
<li><em>Have Fundsquare’s suppliers and vendors been impacted by Log4j vulnerability? </em>Fundsquare is engaging with our supply chain to determine if any suppliers or vendors were impacted by this vulnerability.</li> | <li><em>Have Fundsquare’s suppliers and vendors been impacted by Log4j vulnerability?<br /></em>Fundsquare is engaging with our supply chain to determine if any suppliers or vendors were impacted by this vulnerability.</li> | ||
</ul> | </ul> | ||
Should you require additional information, please do not hesitate to contact our Client Service and Operations Desk at '''[mailto:cso.desk@fundsquare.net cso.desk@fundsquare.net]''' | Should you require additional information, please do not hesitate to contact our Client Service and Operations Desk at '''[mailto:cso.desk@fundsquare.net cso.desk@fundsquare.net]''' | ||
Revision as of 10:51, 14 December 2021
Fundsquare’s Response to CVE-2021-44228 Apache Log4j
Updated 14 December 2021 07:00 CET (GMT+1).
We will continue to update this page as more information becomes available.
On 9 December 2021, Apache published a zero-day vulnerability (CVE-2021-44228) for Apache Log4j being referred to as “Log4Shell”. This vulnerability has been classified as “Critical” with a CVSS score of 10, allowing for Remote Code Execution with system-level privileges. Apache Log4j is java software widely used by many companies for logging purposes. It is often included or bundled with third-party software packages. This vulnerability exists in Log4j versions 2.0 through 2.14 and if exploited, allows an attacker the ability to remotely access and control systems where the software resides.
Current Situation:
The security of Fundsquare’s products (available on e-file.lu and fundsquare.net) and our customer’s safety is a top priority. In response to this vulnerability, Fundsquare has taken immediate action to proactively address any critical vulnerability affecting our products and solutions containing the Log4j software library.
Upon notification of the Log4j vulnerability report our Security Team initiated investigations in accordance with our incident response processes. Fundsquare followed the guidance issued to all Log4j customers in addition to following our internal processes for investigation, forensics analysis, and threat mitigation. Fundsquare will continue to remain vigilant regarding all aspects of this challenging and evolving situation.
At this time, there have been no successful exploits observed in Fundsquare products, solutions or in the Fundsquare environment. This page will be updated on an ongoing basis to reflect most current status.
Fundsquare also plans to provide answers to common questions on this webpage. It should be considered the single source of current, up-to-date, authorized, and accurate information from Fundsquare.
Frequently Asked Questions (Updated December 14, 2021 - 11:45 CET)
- Are Fundsquare products affected by the Log4j vulnerability? Which Products were affected?
The moment we received an alert, our security team immediately took the necessary action to analyse the impact of this finding over our organization and solutions. Patching of potentially impacted components has started and we follow the guidelines of experts to mitigate the risk and vulnerability caused by this security issue. - What remediation actions have been taken?
All Fundsquare products, software and infrastructure are being evaluated and countermeasures have been or are going to be implemented for protection. - Will this incident impact or interrupt the delivery of Fundsquare products and services?
At this time, we are not anticipating any service disruptions for any Fundsquare products or services. - What is the impact to Fundsquare’s business?
There is no impact to Fundsquare’s business at this time. - How does Fundsquare protect its environment from potentially affected software?
Generally, Fundsquare does not disclose the details of its Cyber Security program. In response to this vulnerability, Fundsquare has followed the recommendations from Apache and local Cybersecurity and Infrastructure Agencies. These actions also include patching and increased monitoring. Our security team and partners work hard to protect Fundsquare. - Is an update of e-file.lu and its components required?
The advantage of e-file.lu is its deployment online through our website. In case of a required update due to a patch, we can manage this update from our back end and the next time you load the page, the patched version will be loaded. This would also be the case for the transmission module that constantly checks for updates when you launch it. A separate information would be issued in case of a necessary update of the sending service that may run locally at our clients. At this moment of the release of this information, no update is scheduled. - Have Fundsquare’s suppliers and vendors been impacted by Log4j vulnerability?
Fundsquare is engaging with our supply chain to determine if any suppliers or vendors were impacted by this vulnerability.
Should you require additional information, please do not hesitate to contact our Client Service and Operations Desk at cso.desk@fundsquare.net