https://foojayio.github.io/website/today/author/karsten-silz/Articles written by Karsten Silz on foojay.io - Friends of OpenJDKHugoen-usMon, 10 Jan 2022 10:03:24 +0000https://foojayio.github.io/website/today/log4shell-shows-the-need-for-trustworthy-java/Mon, 10 Jan 2022 10:03:24 +0000https://foojayio.github.io/website/today/log4shell-shows-the-need-for-trustworthy-java/<h2 id="h2-0-what-just-happened">What Just Happened?</h2> <p>I believe Log4Shell is Java&rsquo;s biggest crisis. I reported on it in the &ldquo;<a href="https://betterprojectsfaster.com/guide/java-full-stack-report-2022-01-new-noteworthy" target="_blank" rel="noopener noreferrer">New &amp; Noteworthy</a> &rdquo; section of <a href="https://bpfnl.substack.com" target="_blank" rel="noopener noreferrer">my newsletter</a> . A quick recap: The US cybersecurity and infrastructure agency director <a href="https://www.zdnet.com/article/log4j-flaw-this-new-threat-is-going-to-affect-cybersecurity-for-a-long-time/" target="_blank" rel="noopener noreferrer">called Log4Shell</a> &ldquo;one of the most serious that I&rsquo;ve seen in my entire career, if not the most serious&rdquo;. Exploiting it may be as easy as sending an HTTP request to a Java application, with a JNDI link in the HTTP header. The last wide-spread software vulnerability of this magnitude <a href="https://nvd.nist.gov/vuln/detail/CVE-2014-0160" target="_blank" rel="noopener noreferrer">scored 7.5</a> - Log4Shell <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44228#" target="_blank" rel="noopener noreferrer">scored a 10</a> .</p>