Remote code injection in Log4j

A popular logging tool used by a large number of projects exhibited a vulnerability allowing remote code execution. A second vulnerability came later.

Impact

The impact, possibly illustrated by the US-specific references cited below, can’t be overstated. This is due to the critical nature of the vulnerability, ease of exploitation, pervasiveness and high degree of composability of this component, coupled with the one-two vulnerability disclosures in December followed by another wave for Log4j 1.x in January.

This incident triggered several conversations in the industry including detection, hotpatching techniques and open source sustainability.

Type of Compromise

While this was a source code compromise, it was compounded by all the factors above.

References