Log4jã®è„†å¼±æ€§å¯¾ç–ã¨ã—ã¦AWS WAFã®ãƒžãƒãƒ¼ã‚¸ãƒ‰ãƒ«ãƒ¼ãƒ«ã«ã€ŒLog4JRCEã€ãŒè¿½åŠ ã•ã‚Œã¾ã—㟠| DevelopersIOAWSãƒãƒ¼ãƒ ã®ã™ãšãã§ã™ã€‚ 2021å¹´12月11日〠AWS ã® Managed Ruleã¨ã—ã¦æä¾›ã•ã‚Œã¦ã„ã‚‹ AWSManagedRulesKnownBadInputsRuleSetã«æ–°ã—ã„ä¿è·ãƒ«ãƒ¼ãƒ«ã€ŒLog4JRCEã€ãŒè¿½åŠ ã•ã‚Œã¾ã—ãŸã€‚ Apache Log4j2 Issue (CVE-2021-44228) Log4j ã®è„†å¼±æ€§(CVE-2021-44228)対ç–ã¨ã—ã¦ã€AWS WAFã®æœ‰åŠ¹æ€§ã‚’確ã‹ã‚る機会ãŒã‚ã‚Šã¾ã—ãŸã®ã§ã€ç´¹ä»‹ã•ã›ã¦ã„ãŸã ãã¾ã™ã€‚ AWS Managed Rule Known bad inputs æ–°ã—ã„ルール 「Log4JRCE〠ãŒè¿½åŠ ã•ã‚Œã¾ã—ãŸã€‚ 試ã—ã¦ã¿ãŸ WAF(ACLs)è¨å®š AWSManagedRulesKnownBadInputsRuleSet ã®ã¿è¨å®šã—㟠WebACLを用æ„ã—ã¾ã—ãŸã€‚ BadInputsRuleSetã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã€æ¤œè¨¼
ãã‚ãã‚WAFã«é–¢ã—ã¦ä¸€è¨€ã„ã£ã¨ãã‹ï½žä¸‰é‡è‹¦ã‚’乗り越ãˆã¦WAFãŒæ™®åŠã™ã‚‹ãŸã‚ã®æ¡ä»¶ã¨ã¯ï½ž
誤ã£ãŸWAFã®ä½¿ã„æ–¹ – 国連ã§ã‚‚
アカマイãŒâ€œã‚¯ãƒ©ã‚¦ãƒ‰ãƒ™ãƒ¼ã‚¹ã®WAFâ€ã‚’実ç¾ã€PCIDSSæº–æ‹ ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã¨ã—ã¦æä¾›
{{#tags}}- {{label}}
{{/tags}}