You can now find Cyber Kendra on Google News | Telegram

China Suspends Partnership with Alibaba Cloud for Log4Shell Vulnerability

China government suspends partnership with Alibaba Cloud for not sharing details of Log4Shell.

Log4j vulnerability, Log4Shell exploit

On Wednesday, the Chinees Ministry of Industry and Information Technology (MIIT) has suspended the cooperative deal with Alibaba Cloud Computing, a subsidiary of Chinese e-commerce giant Alibaba Group, for failing to promptly report and address a critical security vulnerability of Apache Log4j logging library which affecting the whole internet.

"Alibaba Cloud did not immediately report vulnerabilities in the popular, open-source logging framework Apache Log4j2 to China's telecommunications regulator," Reuters said. "In response, MIIT suspended a cooperative partnership with the cloud unit regarding cybersecurity threats and information-sharing platforms."

The partnership is been suspended for six months and the Chinese government has asked state-owned companies to migrate their data from private operators such as Alibaba and Tencent to a state-backed cloud system by next year.

The vulnerability in the Apache Log4j library is tracked as CVE-2021-44228 (CVSS score:10.0) is been also known as Log4Shell and CVE-2021-45046 (CVSS Score:9.0) are remote code execution flaws that allow the hackers to execute code with a simple line of payload.

Initially, we have reported that the Log4Shell vulnerability that has triggered a wave of panic among corporations and governments around the world is been discovered by Alibaba Cloud and the team reported the vulnerability to the U.S.-based Apache Software Foundation.

“This vulnerability may lead to remote control of equipment, which may lead to serious harms such as the theft of sensitive information and interruption of equipment services. It is a high-risk vulnerability,"

Google says more than 35,000 Java packages, amounting to over 8% of the Maven Central repository (the most significant Java package repository), have been impacted by the recently disclosed log4j vulnerabilities.

Moreover, now Log4Shell flaws are being exploited by Conti Ransomware Group and many other groups. Microsoft and BitDefender reported that CVE-2021-44228 is being exploited for deploying ransomware on the vulnerable system. 

Post a Comment

Cookie Consent
We serve cookies on this site to analyze traffic, remember your preferences, and optimize your experience.
It seems there is something wrong with your internet connection. Please connect to the internet and start browsing again.
AdBlock Detected!
We have detected that you are using adblocking plugin in your browser.
The revenue we earn by the advertisements is used to manage this website, we request you to whitelist our website in your adblocking plugin.
Site is Blocked
Sorry! This site is not available in your country.