Log4Shell
A critical remote code execution vulnerability disclosed in 2021 within the Apache Log4j logging library, affecting millions of systems worldwide. The incident exposed structural deficiencies in the long-term maintenance and resourcing of widely adopted open-source components that underpin critical infrastructure.
Core Facts
The Log4j vulnerability was discovered in 2021, designated CVE-2021-44228, and is a remote code execution vulnerability affecting this widely used Java logging library.
The Log4Shell vulnerability in 2021 affected hundreds of millions of Java applications worldwide.
Log4Shell (CVE-2021-44228) received a perfect CVSS score of 10.0.
Timeline (last 90 days)
From Log4Shell to Node2Shell, attackers continue to look for common defects in underlying general-purpose components.
The US government drove the trend toward mandatory SBOMs after the Log4Shell incident in 2021.
When an event like Log4Shell occurs, being able to confirm within seconds from the SBOM whether you are affected is much faster than grepping through the repository.
A self-updating process actively pulls new code from a remote source and executes it at runtime; if the update path is hijacked or the upstream is poisoned, the local environment will execute untrusted code without human review, making this a high-incidence point of software supply chain risk.
Software supply chain security has received widespread attention in recent years due to major incidents such as Log4Shell and SolarWinds.
The name Plugin4Shell evokes the earlier Log4Shell vulnerability, suggesting a possible connection to plugin loading mechanisms or injection chains.
The SolarWinds incident in 2021 and the Log4j vulnerability incident in 2022 made the industry aware of the severity of supply chain risks
The Log4Shell vulnerability of 2021 affected hundreds of millions of applications worldwide.
Following the SolarWinds incident and the Log4Shell vulnerability, the U.S. White House issued Executive Order EO 14028, requiring software vendors to provide an SBOM (Software Bill of Materials).
The Heartbleed vulnerability in OpenSSL and the Log4Shell vulnerability in Log4j exposed systemic issues of insufficient maintenance resources for critical open-source projects.
4 more timeline events
All Facts (19)
The Log4j vulnerability was discovered in 2021, designated CVE-2021-44228, and is a remote code execution vulnerability affecting this widely used Java logging library.
80%VerifiedThe Log4Shell vulnerability in 2021 affected hundreds of millions of Java applications worldwide.
75%VerifiedLog4Shell (CVE-2021-44228) received a perfect CVSS score of 10.0.
75%VerifiedCVE-2021-44228 is the well-known Log4Shell vulnerability
70%VerifiedThe Log4Shell vulnerability incident occurred in 2021.
70%UnverifiedThe Log4j vulnerability (CVE-2021-44228) allows attackers to trigger a JNDI lookup via a crafted string to achieve unauthenticated remote code execution.
60%UnverifiedFrom Log4Shell to Node2Shell, attackers continue to look for common defects in underlying general-purpose components.
50%UnverifiedThe US government drove the trend toward mandatory SBOMs after the Log4Shell incident in 2021.
50%UnverifiedWhen an event like Log4Shell occurs, being able to confirm within seconds from the SBOM whether you are affected is much faster than grepping through the repository.
50%UnverifiedA self-updating process actively pulls new code from a remote source and executes it at runtime; if the update path is hijacked or the upstream is poisoned, the local environment will execute untrusted code without human review, making this a high-incidence point of software supply chain risk.
50%UnverifiedSoftware supply chain security has received widespread attention in recent years due to major incidents such as Log4Shell and SolarWinds.
50%UnverifiedThe name Plugin4Shell evokes the earlier Log4Shell vulnerability, suggesting a possible connection to plugin loading mechanisms or injection chains.
50%UnverifiedFollowing the SolarWinds incident and the Log4Shell vulnerability, the U.S. White House issued Executive Order EO 14028, requiring software vendors to provide an SBOM (Software Bill of Materials).
50%UnverifiedThe Heartbleed vulnerability in OpenSSL and the Log4Shell vulnerability in Log4j exposed systemic issues of insufficient maintenance resources for critical open-source projects.
50%UnverifiedThe CVE number format is CVE-YYYY-NNNNN, where CVE-2021-44228 is the well-known Log4Shell vulnerability.
50%UnverifiedLog4Shell漏洞（CVE-2021-44228）被安全研究人员评为CVSS满分10.0，利用门槛极低，仅需在日志中注入一段JNDI查询字符串
50%UnverifiedThe SolarWinds incident in 2021 and the Log4j vulnerability incident in 2022 made the industry aware of the severity of supply chain risks
50%UnverifiedThe Log4Shell vulnerability of 2021 affected hundreds of millions of applications worldwide.
50%UnverifiedThe Log4Shell vulnerability originated in a logging library maintained by volunteers and affected billions of devices worldwide.
50%