Log4j
A Java logging library maintained by the Apache Software Foundation. In 2021, a critical remote code execution vulnerability (CVE-2021-44228) was disclosed. Because Log4j is embedded in hundreds of millions of applications worldwide, the vulnerability triggered a large-scale security crisis.
Core Facts
Timeline (last 90 days)
After the Log4j vulnerability incident in 2021, the United States pushed SBOM into the regulatory spotlight, with an executive order requiring software vendors supplying the federal government to provide SBOMs.
Log4j is depended upon by hundreds of millions of Java applications
The SolarWinds incident in 2021 and the Log4j vulnerability incident in 2022 made the industry aware of the severity of supply chain risks
The Heartbleed vulnerability in OpenSSL and the Log4Shell vulnerability in Log4j exposed systemic issues of insufficient maintenance resources for critical open-source projects.
All Facts (6)
Log4j漏洞于2021年被发现，编号为CVE-2021-44228，是一个远程代码执行漏洞，影响这个被广泛使用的Java日志库
70%UnverifiedAfter the Log4j vulnerability incident in 2021, the United States pushed SBOM into the regulatory spotlight, with an executive order requiring software vendors supplying the federal government to provide SBOMs.
50%UnverifiedLog4j is depended upon by hundreds of millions of Java applications
50%UnverifiedThe Heartbleed vulnerability in OpenSSL and the Log4Shell vulnerability in Log4j exposed systemic issues of insufficient maintenance resources for critical open-source projects.
50%UnverifiedLog4j漏洞（CVE-2021-44228）允许攻击者通过特制字符串触发JNDI查找实现无需认证的远程代码执行
50%UnverifiedThe SolarWinds incident in 2021 and the Log4j vulnerability incident in 2022 made the industry aware of the severity of supply chain risks
50%