Like many other companies, we’re closely following the multiple CVEs regarding Apache Log4j 2. Our security teams are investigating any potential impact on Google products and services and are focused on protecting our users and customers.
We encourage anyone who manages environments containing Log4j 2 to update to the latest version.
Based on findings in our ongoing investigations, here is our list of product and service updates as of December 17th (CVE-2021-44228 & CVE-2021-45046):
Android is not aware of any impact to the Android Platform or Enterprise. At this time, no update is required for this specific vulnerability, but we encourage our customers to ensure that the latest security updates are applied to their devices.
Chrome OS releases and infrastructure are not using versions of Log4j affected by the vulnerability.
Chrome Browser releases, infrastructure and admin console are not using versions of Log4j affected by the vulnerability.
Google Cloud has a specific advisory dedicated to updating customers on the status of GCP and Workspace products and services.
Google Marketing Platform, including Google Ads is not using versions of Log4j affected by the vulnerability. This includes Display & Video 360, Search Ads 360, Google Ads, Analytics (360 and free), Optimize 360, Surveys 360 & Tag Manager 360.
YouTube is not using versions of Log4j affected by the vulnerability.
We will continue to update this advisory with the latest information.
The latest news and insights from Google on security and safety on the Internet
No comments:
Post a Comment
You are welcome to contribute comments, but they should be relevant to the conversation. We reserve the right to remove off-topic remarks in the interest of keeping the conversation focused and engaging. Shameless self-promotion is well, shameless, and will get canned.
Note: Only a member of this blog may post a comment.