Apache Log4j
A logging library used across the Java world.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- App
- FrameworkLog4j
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
About
Log4j is a logging library that Java applications use to record what they do. It cannot be seen from the outside because it is buried inside the application. That hidden position is exactly why its 2021 flaw was so hard to find and fix.
If It Has a Flaw
A logging library is called from deep inside an application. So a flaw in it can be reached by any text that ends up in a log, and it runs with the whole application's rights.
Every app built with it is exposed.
Well-Known Flaws
Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where Log4j sits.
CVE-2021-44228 (opens in a new tab)2021
Log4Shell
A logged string containing a JNDI lookup made Log4j fetch and run remote code.
Reach It could be reached from anywhere user input was logged, deep inside countless Java apps.
Stacks and Code
Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- Its Code Comes From
Maven Central