log4shell and NEMO

[Sergi Lendínez]

Hello NEMO community,

Happy new year to everyone!

Here at LSU, our Django has been sending us some errors, warnings and broken link emails (100+ emails/day) for the last month, in what seems to be related to the log4shell vulnerability found recently. I am attaching an example of each of those emails. Is anyone else experiencing something similar?

I was wondering if we need to do something with our NEMO distribution to patch the vulnerability. (We are running the most recent nemo v3.13.2 and we have also just updated the CentOS distribution on the server.)

If NEMO is not vulnerable, how can we prevent these emails?

Thank you very much,

Sergi

        

[Dylan Klomparens]

This blog article may be helpful. Perhaps try it, and see if the errors go down?

https://www.borfast.com/blog/2020/07/06/invalid-http_host-header-errors-in-django-and-nginx/

However, you could very well be vulnerable to log4shell also. Both are possibilities. I recommend consulting your institution's cybersecurity or IT department.

--
You received this message because you are subscribed to the Google Groups "nemo" group.
To unsubscribe from this group and stop receiving emails from it, send an email to nemo+uns...@list.nist.gov.
To view this discussion on the web visit https://groups.google.com/a/list.nist.gov/d/msgid/nemo/64e29290-cb4c-4e44-b93a-2582c857d51an%40list.nist.gov.

[Björn Pedersen]

NEMO is python-based, not java based, so log4j is never used and there is no vulnerability. What you see are mails about URLs that NEMO does not use. Thise are generated by scripts  scanning for log4j-vulnerable services...

Björn

[Chris Schwehm]

Björn,

Thanks.  When you talk about the scanning scripts, are these scripts that are running on the nemo server or are these scripts that are likely being run by our security group on all of our servers looking for vulnerabilities?

Thanks,

Chris Schwehm

--

You received this message because you are subscribed to the Google Groups "nemo" group.
To unsubscribe from this group and stop receiving emails from it, send an email to nemo+uns...@list.nist.gov.

To view this discussion on the web visit https://groups.google.com/a/list.nist.gov/d/msgid/nemo/fe8f1a76-e153-4239-b24a-bd3770bf6df8n%40list.nist.gov.

[Björn Pedersen]

csch...@gmail.com schrieb am Dienstag, 11. Januar 2022 um 16:44:06 UTC+1:

Björn,

Thanks.  When you talk about the scanning scripts, are these scripts that are running on the nemo server or are these scripts that are likely being run by our security group on all of our servers looking for vulnerabilities?

No, those a run by the bad guys(on their servers) , they just  try any public URL if it is vulnerable ( you will also find /wordpress etc. if you look at the logs). There is not much you can do...

 

Björn