🔴 Critical | Source: GCP Compute Engine Security Bulletins
A critical vulnerability in Apache Log4j (CVE-2021-44228), known as Log4Shell, allows attackers to execute arbitrary code on systems running Log4j version 2.14.1 or below by exploiting the JNDI lookup feature via crafted log messages. Google Cloud’s Migrate for Compute Engine (M4CE) was identified as an affected product. This vulnerability has an exceptionally wide blast radius given Log4j’s near-ubiquitous use in Java-based applications.
Security Architect’s Take: If you are running M4CE v4.x, immediately replace your existing deployment with the patched version released on 13 December 2021, covering both the in-cloud M4CE Manager and any on-premises backend components. Additionally, audit all other GCP workloads for Log4j usage and apply patches or mitigations — such as setting
log4j2.formatMsgNoLookups=true— as a matter of urgency.
Original advisory: GCP-2021-026