https://foojayio.github.io/website/today/author/roy-van-rijn/Articles written by Roy van Rijn on foojay.io - Friends of OpenJDKHugoen-usWed, 15 Dec 2021 12:49:15 +0000https://foojayio.github.io/website/today/log4shell-leak4j/Wed, 15 Dec 2021 12:49:15 +0000https://foojayio.github.io/website/today/log4shell-leak4j/<p>Over the last couple of days (and nights) I&rsquo;ve been studying the new (extremely dangerous) vulnerability in log4j2 called <a href="https://en.wikipedia.org/wiki/Log4Shell" target="_blank" rel="noopener noreferrer">Log4Shell</a> ).</p> <p>All versions of log4j-core from 2.0-beta9 to 2.14.1 are affected by this, and it&rsquo;s a <strong>big</strong> one.</p> <p>This vulnerability allows the attacker to remotely execute code on your system, with the ability to get complete control of the underlying servers.</p> <p>Log4J has, for a long time, been the most used logging framework in the Java landscape. It&rsquo;s extremely widely used and this attack has the most broad trigger you can imagine: It needs to log something.</p>