Log4jAttackSurface VS nimbus-eth2

Checkout this link for knowing Log4j impact on manufacturers https://github.com/YfryTchsGD/Log4jAttackSurface

Just look at the currently ongoing insanity that is the log4j exploit, and how one single exploit has lead to a generic attack that can impact tons of companies. Imagine if a state decided to use voting machines, and someone found this style of exploit in the system.

Last week (Dec 9th) a major vulnerability was discovered in an open source logging project for Java called log4j. The vulnerability called Log4Shell would allow anyone to remotely run arbitrary code if they sent a message in the right format to the server. This is one of the worst attacks your system can be susceptible to and if you are interested in the technical details of the problem, here is an overview. The attack surface of Log4Shell is staggering, Amazon, Apple, Google, and the Apache Server are affected; it can almost not get bigger than this. We will see the real fallout of Log4Shell in the next weeks and months as right now servers worldwide are being scanned and prodded for this vulnerability.

Companies should verify they are not running any exposed Log4j Java code.  Here is a list of impacted 3rd party software for your reference.  If you find a server at risk, there are three potential ways to fix it as follows.

Looking for vendors/software on known lists like https://github.com/YfryTchsGD/Log4jAttackSurface

Blender ist nicht betroffen, #42

It does and was also affected by log4j.

Thanks, sure it isn't complete but it does contain some scary and surprising (at least when first reading, of course the really aren't) things like: https://github.com/YfryTchsGD/Log4jAttackSurface/blob/master/pages/UniFi.md

Apparently there's proof Steam along with many others are vulnerable.

Agreed! There's a couple of fairly large projects in Nim: https://nimbus.team/ (https://github.com/status-im/nimbus-eth2) or https://github.com/zedeus/nitter

Though there's still friction points I've been happy seeing the ecosystem grow lately. The compiler has seen a lot of bug fixes lately too which helps.

Pretty big update for Nimbus out today, it's been a long time coming: https://github.com/status-im/nimbus-eth2/releases/tag/v23.6.0

consensus client/execution client -> ERIGON v2.45.2 and NIMBUS v23.5.1

In the same year their beacon chain client followed Bellatrix (Merge) and Capella upgrades without a hitch, which is in many ways more impressive than a messenger.

Nimbus claims to have a solution to the loss of finality problem that was caused by old attestations, by dramatically speeding up the verification of those attestations: https://github.com/status-im/nimbus-eth2/pull/4911

Seems they just released 23.5.0, to fix many of the issues we've been having: https://github.com/status-im/nimbus-eth2/releases/tag/v23.5.0

https://github.com/status-im/nimbus-eth2 69 contributors

Daily Goerli: Was getting a lot of missed attestations with nimbus and after some back and forth with tersec, we confirmed that timeouts communicating with web3signer were the culprit. A fix should be merged soon.