I salute the log4j team! They are working really hard fixing people's issues and making us all safer. Unlucky circumstances involved, and bugs happen. But we shall be very grateful for the work they've done the last few days.
Again reiterating that you need to patch regardless of Java versions. The deser vector will apply to many systems, as the history of Jackson and XStream has shown again and again.
Potential mitigation for use of some third party Java apps that bundle log4j:
Add -Dlog4j2.formatMsgNoLookups=true to beginning of jvm args if configurable. While waiting for patches to the app.
In many cases you can set such args (to tweak memory settings etc).
Finding a good patch policy for npm gets harder every day. Due to malware, quarantining new releases is reasonable. But we must patch known vulns. And vuln feeds miss stuff, so we might not patch important updates then.
Leaving server-side js (node) in a really awkward position.
🚨ONGOING: we are investigating systems infected with a malicious version of the npm package UAParser.js (7 million weekly downloads).
The hijacked package delivers a malware loader and a cryptominer.
IOCs below: