Log4j
A Java logging library maintained by the Apache Software Foundation. In 2021, a critical remote code execution vulnerability (CVE-2021-44228) was disclosed. Because Log4j is embedded in hundreds of millions of applications worldwide, the vulnerability triggered a large-scale security crisis.
Core Facts
Timeline (last 90 days)
The supply chain risk of open-source infrastructure lies in the fact that core components such as PHP, OpenSSL, and Log4j are indirectly depended on by countless downstream projects, so a single vulnerability can rapidly amplify along the dependency chain.
After the Log4j vulnerability incident in 2021, the United States pushed SBOM into the regulatory spotlight, with an executive order requiring software vendors supplying the federal government to provide SBOMs.
Open-source public infrastructure refers to open-source projects that are widely relied upon but are often maintained by a small number of volunteers or a small team, such as OpenSSL, cURL, log4j, and others.
Log4j is depended upon by hundreds of millions of Java applications
The SolarWinds incident in 2021 and the Log4j vulnerability incident in 2022 made the industry aware of the severity of supply chain risks
The Heartbleed vulnerability in OpenSSL and the Log4Shell vulnerability in Log4j exposed systemic issues of insufficient maintenance resources for critical open-source projects.
All Facts (8)
The Log4j vulnerability was discovered in 2021, designated CVE-2021-44228, and is a remote code execution vulnerability affecting this widely used Java logging library.
80%UnverifiedThe Log4j vulnerability (CVE-2021-44228) allows attackers to trigger a JNDI lookup via a crafted string to achieve unauthenticated remote code execution.
60%UnverifiedThe supply chain risk of open-source infrastructure lies in the fact that core components such as PHP, OpenSSL, and Log4j are indirectly depended on by countless downstream projects, so a single vulnerability can rapidly amplify along the dependency chain.
50%UnverifiedAfter the Log4j vulnerability incident in 2021, the United States pushed SBOM into the regulatory spotlight, with an executive order requiring software vendors supplying the federal government to provide SBOMs.
50%UnverifiedOpen-source public infrastructure refers to open-source projects that are widely relied upon but are often maintained by a small number of volunteers or a small team, such as OpenSSL, cURL, log4j, and others.
50%UnverifiedLog4j is depended upon by hundreds of millions of Java applications
50%UnverifiedThe Heartbleed vulnerability in OpenSSL and the Log4Shell vulnerability in Log4j exposed systemic issues of insufficient maintenance resources for critical open-source projects.
50%UnverifiedThe SolarWinds incident in 2021 and the Log4j vulnerability incident in 2022 made the industry aware of the severity of supply chain risks
50%