오픈소스보안 on OpenChain KWGhttps://korea-wg.openchainproject.org/tags/%EC%98%A4%ED%94%88%EC%86%8C%EC%8A%A4%EB%B3%B4%EC%95%88/Recent content in 오픈소스보안 on OpenChain KWGHugokoTue, 10 Nov 2026 18:49:56 +090012th Meetinghttps://korea-wg.openchainproject.org/meeting/2021/12th/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/meeting/2021/12th/<div ><span class="image fit"> <img src="christmas_game.png" width="50%"> </span></div> <h2 id="일정">일정</h2> <ul> <li>일정: 2021-12-20 (월) 오후2시~</li> <li>장소 <ul> <li><a href="https://www.gather.town/">Gather Town</a> (접속 방법은 별도 메일 공지 참고)</li> </ul> </li> </ul> <h2 id="agenda">Agenda</h2> <table> <thead> <tr> <th>No</th> <th>Agenda</th> <th>Speaker</th> <th>Slide</th> </tr> </thead> <tbody> <tr> <td>1</td> <td>OpenChain Update</td> <td>Shane Coughlan, Linux Foundation</td> <td>-</td> </tr> <tr> <td>2</td> <td>OpenChain KWG Update</td> <td>장학성, SK텔레콤</td> <td><a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2021/OpenChain_Korea_update_20211220.pdf">pdf</a></td> </tr> <tr> <td>3</td> <td>중국 GPL 소송 사례</td> <td>장학성, SK텔레콤</td> <td><a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2021/virtualapp_case_20211220.pdf">pdf</a></td> </tr> <tr> <td>4</td> <td>최근 소송 사례 : Stockfish v. ChessBase, SFC v. Vizio</td> <td>박원재, LG전자</td> <td><a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2021/stockfish_n_sfc_case_211220.pdf">pdf</a></td> </tr> <tr> <td>5</td> <td>Shift-left and Automate Compliance Checks</td> <td>Arlo (하헌관), 카카오뱅크</td> <td><a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2021/Shift-Left_and_Automate_Compliance_Checks.pdf">pdf</a></td> </tr> <tr> <td>6</td> <td>소그룹 모임 (Case Study)</td> <td>All</td> <td>-</td> </tr> <tr> <td>7</td> <td>오징어게임</td> <td>All</td> <td>-</td> </tr> <tr> <td>8</td> <td>오픈소스 보안취약점 공격 유형</td> <td>Robin (황민호), 카카오</td> <td><a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2021/OpenSourceVulnerability_20211220.pdf">pdf</a></td> </tr> </tbody> </table> <h2 id="소그룹-모임-주제">소그룹 모임 주제</h2> <ol> <li>(개인, 회사) 올 한해 어땠는지? 내년 계획이 있다면?</li> <li>KWG에 바라는 점이 있다면 (한분이 취합하여 공유)</li> </ol> <h2 id="video">Video</h2> <h3 id="openchain-update">OpenChain Update</h3> <iframe width="560" height="315" src="https://www.youtube.com/embed/RA8rnLFmSvE" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> <h3 id="openchain-kwg-update">OpenChain KWG Update</h3> <iframe width="560" height="315" src="https://www.youtube.com/embed/f1JbeIb-stA" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> <h3 id="중국-gpl-소송-사례">중국 GPL 소송 사례</h3> <iframe width="560" height="315" src="https://www.youtube.com/embed/teAla8RjniQ" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> <h3 id="최근-소송-사례--stockfish-v-chessbase-sfc-v-vizio">최근 소송 사례 : Stockfish v. ChessBase, SFC v. Vizio</h3> <iframe width="560" height="315" src="https://www.youtube.com/embed/5M6VLarc2N0" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> <h3 id="shift-left-and-automate-compliance-checks">Shift-left and Automate Compliance Checks</h3> <iframe width="560" height="315" src="https://www.youtube.com/embed/z3S_PuqLXVs" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> <h3 id="오픈소스-보안취약점-공격-유형">오픈소스 보안취약점 공격 유형</h3> <iframe width="560" height="315" src="https://www.youtube.com/embed/N7ELgngaTFs" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe> <h2 id="minutes">Minutes</h2> <h3 id="openchain-update-shane-coughlan--linux-foundation">OpenChain Update (Shane Coughlan / Linux Foundation)</h3> <ol> <li>OpenSource License Compliance Management Training course 개설 <ul> <li>무료로 이용 가능하며, Certification도 획득 가능</li> </ul> </li> <li>첫번째 Playbook 발간 <ul> <li>중소 규모의 기업에서 어떻게 OpenChain을 도입할 수 있는지 가이드 <br></li> </ul> </li> </ol> <blockquote> <p>위 두 자료는 [https://www.openchainproject.org/]에서 확인할 수 있음</p> </blockquote>18th Meetinghttps://korea-wg.openchainproject.org/meeting/2023/18th/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/meeting/2023/18th/<h2 id="일정">일정</h2> <ul> <li>일정: 2023-06-22 (목) 오후2시~5시</li> <li>장소: 카카오 판교아지트 (경기도 성남시 분당구 판교역로 166)</li> </ul> <h2 id="아젠다">아젠다</h2> <table> <thead> <tr> <th>No</th> <th>Time</th> <th>Agenda</th> <th>Speaker</th> <th>Slide</th> </tr> </thead> <tbody> <tr> <td>0</td> <td>14:00</td> <td>Welcome &amp; Intro</td> <td>황은경, 카카오</td> <td>-</td> </tr> <tr> <td>1</td> <td>14:10</td> <td>OpenChain Global Update</td> <td>Shane Coughlan, Linux Foundation</td> <td><a href="https://www.slideshare.net/ShaneCoughlan3/openchain-korea-work-group-meeting-18">slide</a></td> </tr> <tr> <td>2</td> <td>14:20</td> <td>OpenChain KWG Update</td> <td>장학성, SK텔레콤 / 이서연, 라인플러스</td> <td><a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2023/OpenChain_Korea_update_20230622.pdf">slide</a></td> </tr> <tr> <td>3</td> <td>14:30</td> <td>(전산학 박사 출신 특허 법무 대학원생이 파헤치는) Copilot 소송 진행 현황</td> <td>박정숙, ETRI</td> <td><a href="./Copilot%EC%86%8C%EC%86%A1%EC%A7%84%ED%96%89%ED%98%84%ED%99%A9_ETRI%EB%B0%95%EC%A0%95%EC%88%99-R4.pdf">slide</a></td> </tr> <tr> <td>4</td> <td>15:00</td> <td>Break &amp; Networking</td> <td>all</td> <td>-</td> </tr> <tr> <td>5</td> <td>15:15</td> <td>FOSSLight + Security Release</td> <td>석지영, LG전자</td> <td><a href="./230622_FOSSLight_Hub_Security%EA%B8%B0%EB%8A%A5%EC%86%8C%EA%B0%9C.pdf">slide</a></td> </tr> <tr> <td>6</td> <td>15:30</td> <td>오소리 프로젝트, 웅장한 계획을 밝히다</td> <td>정윤환, 삼성전자</td> <td><a href="./OSORI_%EC%98%A4%ED%94%88%EC%B2%B4%EC%9D%B8KWG_20230622_%EB%B0%9C%ED%91%9C-2.pdf">slide</a></td> </tr> <tr> <td>7</td> <td>16:00</td> <td>그룹 토의</td> <td>all</td> <td>-</td> </tr> </tbody> </table> <ul> <li>후기 : <a href="https://tech.kakao.com/2023/07/10/openchain-kwg-18th-meeting/">오픈소스는 저희에게 맡겨주세요! OpenChain Korea Work Group 모임 후기</a></li> </ul> <h2 id="sponsor">Sponsor</h2> <p><img src="nipg-logo.png" alt="" width="400" height="74" loading="lazy" decoding="async"> <br> <img src="./kakao.png" alt="" width="184" height="88" loading="lazy" decoding="async"> </p>19th Meetinghttps://korea-wg.openchainproject.org/meeting/2023/19th/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/meeting/2023/19th/<h2 id="일정">일정</h2> <ul> <li>일정: 2023-09-19 (화) 오후1시30분~5시</li> <li>장소: 현대오토에버 (서울특별시 강남구 테헤란로 510)</li> </ul> <h2 id="아젠다">아젠다</h2> <h3 id="세션-0-intro--update">세션 0. Intro &amp; Update</h3> <table> <thead> <tr> <th>Time</th> <th>Agenda</th> <th>Speaker</th> <th>Slide</th> </tr> </thead> <tbody> <tr> <td>13:30~13:40</td> <td>Welcome &amp; Intro</td> <td>민석기/류창한, 현대오토에버</td> <td>-</td> </tr> <tr> <td>13:40~13:50</td> <td>OpenChain Global Update</td> <td>Shane Coughlan, Linux Foundation</td> <td>-</td> </tr> <tr> <td>13:50~14:00</td> <td>OpenChain KWG Update <br> Legal subgroup 소개</td> <td>장학성, SK텔레콤 / 이서연, 라인플러스 <br> 박정숙, ETRI</td> <td><a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2023/OpenChain_Korea_update_20230919.pdf">slide</a> <br> <a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2023/LegalSubgroup_Intro_20230919-R1.pdf">slide</a></td> </tr> </tbody> </table> <h3 id="세션-1-현대차그룹과-오픈소스">세션 1. 현대차그룹과 오픈소스</h3> <table> <thead> <tr> <th>Time</th> <th>Agenda</th> <th>Speaker</th> <th>Slide</th> </tr> </thead> <tbody> <tr> <td>14:00~14:10</td> <td>현대차그룹 오픈소스 리스트 공개를 통한 중소/중견기업 지원 방안</td> <td>류창한, 현대오토에버</td> <td><a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2023/HyundaiMotorGroup_OpenSource_List_by_Technology_F.pdf">slide</a></td> </tr> <tr> <td>14:10~14:40</td> <td>현대차그룹 오픈소스 관리시스템 구축 사례<br> - 현대자동차<br> - 현대모비스<br> - 현대오토에버</td> <td><br>이창우, 현대자동차<br>이영준, 현대모비스<br>이지현, 현대오토에버</td> <td><br> <a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2023/KWG_HyundaiMotor_presentation.pdf">slide</a> <br> <a href="./%EB%AA%A8%EB%B9%84%EC%8A%A4_KWG_%EB%B0%9C%ED%91%9C%EC%9E%90%EB%A3%8C.pdf">slide</a> <br> <a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2023/fosslight_case_study_20230919_Autoever.pdf">slide</a></td> </tr> <tr> <td>14:40~15:00</td> <td>네트워킹</td> <td>ALL</td> <td>-</td> </tr> </tbody> </table> <h3 id="세션-2-best-practice">세션 2. Best Practice</h3> <table> <thead> <tr> <th>Time</th> <th>Agenda</th> <th>Speaker</th> <th>Slide</th> </tr> </thead> <tbody> <tr> <td>15:00~15:20</td> <td>LG전자 제품 보안 관리 체계 기반 오픈소스 보안 보증 표준 준수 사례 소개</td> <td>정재욱, LG전자</td> <td><a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2023/LGE_ProductSecurity_OpenSourceSecurity_Compliance_JungJaewook.pdf">slide</a></td> </tr> <tr> <td>15:20~15:40</td> <td>우당탕탕 LINE의 OpenChain 인증 여정</td> <td>이서연/김동혁, 라인플러스</td> <td><a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2023/LINE-OpenChain-Conformance.pdf">slide</a></td> </tr> <tr> <td>15:40~16:00</td> <td>혼돈의 AI 오픈 소스 라이선스</td> <td>최혜성, LG전자</td> <td><a href="https://github.com/OpenChain-Project/OpenChain-KWG/releases/download/meeting-slides-2023/AI_OpenSource_License_Chaos.pdf">slide</a></td> </tr> <tr> <td>16:00~16:20</td> <td>네트워킹</td> <td>ALL</td> <td>-</td> </tr> </tbody> </table> <h3 id="세션-3-그룹-토의">세션 3. 그룹 토의</h3> <table> <thead> <tr> <th>Time</th> <th>Agenda</th> <th>Speaker</th> <th>Slide</th> </tr> </thead> <tbody> <tr> <td>16:20~17:00</td> <td>그룹 토의</td> <td>ALL (진행 : 이서연, 라인플러스)</td> <td>-</td> </tr> </tbody> </table> <h2 id="sponsor">Sponsor</h2> <p><img src="autoever-logo.png" alt="" width="403" height="125" loading="lazy" decoding="async"> <br></p>Log4j 2 보안 취약점 사태 (Log4Shell)https://korea-wg.openchainproject.org/blog/2021/12/12/log4shell/Sun, 12 Dec 2021 00:00:00 +0000https://korea-wg.openchainproject.org/blog/2021/12/12/log4shell/<p>Apache Log4j 2에서 발생한 취약점(<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228">CVE-2021-44228, NVD</a>)을 통해 악성코드 감염 등 추가 피해가 발생할 수 있어 전 세계적으로 긴급 보안 업데이트 조치 (2021.12.10)가 있었으며, 관련 내용을 정리합니다.</p> <h3 id="log4j">Log4j</h3> <p>Log4j는 로그를 목적으로 Java 기반의 웹서비스에서 대부분 사용되는 Apache 재단의 오픈소스입니다. <img src="featured-log4j.png" alt="log4j-logo" width="363" height="139" loading="lazy" decoding="async"> </p> <h3 id="경과">경과</h3> <ul> <li>2021.11.24 알리바바 클라우드 보안팀에서 최초로 발견 (<a href="https://logging.apache.org/log4j/2.x/security.html">Apache 공지</a>)</li> <li>2021.11.30 Log4j팀, <a href="https://github.com/apache/logging-log4j2/pull/608">Restrict LDAP access via JNDI</a> pull request 추가 (12/5 Merged)</li> <li>2021.11.30 Log4j팀, <a href="https://github.com/apache/logging-log4j2/pull/607">no longer formats lookups in messages by default</a> pull request 추가 (12/5 Merged)</li> <li>2021.12.09 log4j 2 보안 이슈 PR과 취약성 재현 스샷이 한 <a href="https://twitter.com/P0rZ9/status/1468949890571337731">트윗</a>에 올라오면서 이슈가 퍼지기 시작</li> <li>2021.12.10 마인크래프트 기술 책임자가 관련 이슈 수정하였다며 <a href="https://twitter.com/slicedlime/status/1469150993527017483">트윗</a>으로 알리면서 본격 이슈화</li> <li>2021.12.10 Log4j <strong>2.15.0 버전 릴리즈</strong> 로 보안 취약성 패치</li> <li>2021.12.12 Log4j팀, <a href="https://github.com/apache/logging-log4j2/commit/44569090f1cf1e92c711fb96dfd18cd7dccc72ea">Disable JNDI by default</a> 추가</li> <li>2021.12.12 Log4j 2.15.1 버전 릴리즈 후보 (JNDI 기본값 Disable)</li> </ul> <h3 id="보도자료-국내">보도자료 (국내)</h3> <ul> <li>2021.12.11 <a href="https://www.yna.co.kr/view/AKR20211211035951009?section=popup/print">&ldquo;컴퓨터 역사상 최악 취약점 발견&rdquo; 전세계 보안업계 화들짝</a></li> <li>2021.12.11 <a href="https://news.naver.com/main/tool/print.naver?oid=092&amp;aid=0002241848">거의 모든 서버 위협하는 최악의 &lsquo;로그4j&rsquo; 보안허점 발견</a></li> <li>2021.12.11 <a href="https://news.naver.com/main/tool/print.naver?oid=421&amp;aid=0005778626">&ldquo;컴퓨터 역사상 최악의 취약점 발견&rdquo; 보도에 국정원 &ldquo;선제적 조치 취해&rdquo;</a></li> <li>2021.12.12 <a href="https://v.kakao.com/v/20211212103345131">과기정통부, &lsquo;치명적 보안 취약&rsquo; 오픈소스 &lsquo;로그4j&rsquo; 긴급 보안조치 권고</a></li> <li>2021.12.12 <a href="https://v.kakao.com/v/20211212180303915">&ldquo;최악의 보안 결함&rdquo;..발칵 뒤집힌 IT업계</a></li> <li>2021.12.12 <a href="https://v.kakao.com/v/20211212184805464">전자신문, 피해 파악 어려워..SW 세부 내역 파악해야</a></li> <li>2021.12.12 <a href="https://v.kakao.com/v/20211212193223921">IT서버 해킹 우려에 &lsquo;긴급 대응팀&rsquo; 가동</a></li> <li>해외 기사는 &ldquo;<strong>Log4Shell</strong>&rdquo; 로 검색</li> </ul> <h3 id="대응방안">대응방안</h3> <ul> <li><strong><a href="https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592">Log4Shell에 연결된 보안 권고/공고(CVE-2021-44228)</a></strong></li> <li>2021.12.06 <a href="https://logging.apache.org/log4j/2.x/">Apache 2.15.0 CVE-2021-44228 관련 내용 고지</a></li> <li>2021.12.10 <a href="https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot">Spring, Log4J2 Vulnerability and Spring Boot</a> (영문)</li> <li>2021.12.11 <a href="https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=36389">KISA, Apache Log4j 2 보안 업데이트 권고</a></li> <li>2021.12.12 <a href="https://www.korea.kr/news/pressReleaseView.do?newsId=156485848">과기정통부, Apache Log4j 2 웹 서비스 긴급 보안패치 권고</a> (가이드는 위 내용과 동일)</li> </ul> <h3 id="대응-사례-참고">대응 사례 (참고)</h3> <ul> <li>2021.12.10 <a href="https://aws.amazon.com/ko/security/security-bulletins/AWS-2021-005">AWS, Apache Log4j2 Issue</a> (영문)</li> <li>2021.12.11 <a href="https://blog.cloudflare.com/how-cloudflare-security-responded-to-log4j2-vulnerability/">Cloudflare Security의 Log4j 2 취약점 대응</a> (영문)</li> </ul> <h3 id="영향범위">영향범위</h3> <ul> <li> <p>Log4j 2.0-beta9 부터 2.15.x 이전 버전</p> </li> <li> <p><a href="https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot">Spring Boot 관련</a></p> <ul> <li>Spring Boot는 또 다른 로그 라이브러리인 Logback을 디폴트로 하고 있으며,<br> <a href="https://docs.spring.io/spring-boot/docs/current/reference/html/howto.html#howto.logging.log4j">기본 로깅 시스템을 Log4j2로 전환한 경우</a> 취약점의 영향을 받습니다.</li> <li>2021.12.12 현재 최신 버전인 Spring Boot 2.6.1 에서는 Log4j2 로 전환시 버전을 명시하지 않으면 1.14.1 로 설치됨</li> <li>현재 릴리즈 전인 Spring Boot 2.6.2 에서는 Log4j 2.15.x 로 업데이트 예정</li> </ul> </li> </ul>