December 9, 2021
Log4Shell vulnerability disclosed
Apache disclosed CVECommon Vulnerabilities and Exposures — a public dictionary of known security flaw identifiers.-2021-44228 on December 9, 2021 — Log4ShellA critical 2021 vulnerability in Log4j — remote code execution via crafted log messages., a critical remote code execution flaw in the ubiquitous Log4j logging library.
What it was for
A crafted JNDI lookup string in log messages could execute arbitrary code on millions of JavaA portable language running on the JVM — dominant in enterprise servers, Android, and big data. servers — Minecraft, enterprise apps, and cloud services scrambled to patch over the holidays. Log4ShellA critical 2021 vulnerability in Log4j — remote code execution via crafted log messages. became the benchmarkA standardized test suite for comparing systems — ImageNet, MLPerf, and SPEC define industry scoreboards. for dependency-scanning, runtime WAF rules, and the phrase 'it's always logging' in security memes.
Companies
- Sun Microsystems
Why it's here
Log4ShellA critical 2021 vulnerability in Log4j — remote code execution via crafted log messages. was the most severe open-source supply-chain bug since Heartbleed.
Why it mattered
It made software composition analysis and emergency patching mandatory for JavaA portable language running on the JVM — dominant in enterprise servers, Android, and big data. shops.
What it solved
Nothing until upgraded — any app logging attacker-controlled strings was remotely exploitable.
Media
ImageLog4j - Time based triggered files - 2017-09-27WorkAgain, CC BY-SA 4.0, via wikimedia
Related
- Heartbleed OpenSSL vulnerability disclosedApril 7, 2014
- SolarWinds supply-chain hack disclosedDecember 13, 2020
- Java 1.0 shippedJanuary 23, 1996