This means an attacker who gains access to logging messages could inject fraudulent messages that enable arbitrary code execution and exploitation of a vulnerable system. The RCE flaw is due to the way Log4j interacts with JNDI without properly validating all requests. It excluded security releases 2.12.1 and 2.13.0. 2.ĬVE-2021-44228 is a remote code execution (RCE) flaw in multiple versions of the software, including Log4j2 2.0-beta9 through 2.15.0.

$apache openoffice log4j$

Cisco reported it first spotted attacks against Log4j on Dec. Cloudflare CEO Matthew Prince reported that his firm uncovered evidence of the exploit on Dec. Others knew of the Log4j security issues prior to its public disclosure. LunaSec dubbed the flaw Log4Shell, which is the name by which CVE-2021-44228 and its subsequent flaws have been commonly referred to in the media. 9, researchers at security firm LunaSec publicly disclosed a serious remote code execution vulnerability in Log4j via tweet. 6, but the project didn't publicly disclose the presence of a high-impact security flaw. The Log4j development team had a fix for the issue by Dec. It was first reported to the Apache Software Foundation by Chen Zhaojun of Alibaba Cloud Security Team on Nov. The initial vulnerability in Log4j is known as CVE-2021-44228. The Log4j exploit began as a single vulnerability, but it became a series of issues involving Log4j and the Java Naming and Directory Interface (JNDI) interface, which is the root cause of the exploit. Log4j didn't get much attention until December 2021, when a series of critical vulnerabilities were publicly disclosed.

As such, not every user or organization may be aware they are using Log4j as an embedded component. Log4j is typically deployed as a software library within an application or Java service. It has had a regular series of updates since then. The current branch of Log4j is the Log4j 2 branch, which was generally released in July 2014. The initial release of Log4j was in October 1999, with the 1.0 release becoming generally available in January 2001.

Apache openoffice log4j