Log4j is a Java logging library whose vulnerabilities, including Log4Shell, can let attackers execute code through dependent applications.
Search across headline titles and summaries.
Background for this topic.
Apache Log4j is a Java library that records application events, such as errors and user activity, to files, consoles, or other destinations. Log4j 2 is distinct from the older Log4j 1.x branch, and both may appear directly or as transitive dependencies inside larger applications and products.
Security attention centers on Log4Shell (CVE-2021-44228), a flaw in Log4j 2’s JNDI lookup processing. When an application logged attacker-controlled text, a vulnerable configuration could contact an attacker-controlled service and potentially execute code. Effective defense requires identifying bundled and indirect Log4j copies, upgrading to a supported fixed release, and treating exposed applications as potential attack surfaces. Monitoring application and network logs for exploit attempts, followed by focused compromise assessment where vulnerable systems were reachable, remains important because patching alone does not establish whether exploitation occurred.
While attackers and researchers shift their attention to the next new vulnerability, security teams make sure they finish patching vulnerable Log4j versions in their applications and services.
The Log4Shell vulnerabilities in the widely used Log4j software are still leveraged by threat actors today to deploy various malware payloads, including recruiting devices into DDoS botnets and for planting cryptominers. [...]