Log4Shell (English Wikipedia)

"Apache Log4j Security Vulnerabilities". Log4j. Apache Software Foundation. Retrieved 12 December 2021.
"Apache Log4j 2". Apache Software Foundation. Retrieved 12 December 2021.
"Lookups". Log4j. Apache Software Foundation. Retrieved 13 December 2021.

blogs.apache.org

"Apache projects affected by log4j CVE-2021-44228". 14 December 2021.

issues.apache.org

"LOG4J2-3201: Limit the protocols JNDI can use and restrict LDAP". Apache's JIRA issue tracker. Retrieved 14 December 2021.

arstechnica.com

Goodin, Dan (10 December 2021). "Zero-day in ubiquitous Log4j tool poses a grave threat to the Internet". Ars Technica. Retrieved 12 December 2021.
Goodin, Dan (10 December 2021). "The Internet's biggest players are all affected by critical Log4Shell 0-day". ArsTechnica. Retrieved 13 December 2021.
Goodin, Dan (13 December 2021). "As Log4Shell wreaks havoc, payroll service reports ransomware attack". Ars Technica. Retrieved 17 December 2021.

bitdefender.com

businessinsights.bitdefender.com

Zugec, Martin (13 December 2021). "Technical Advisory: Zero-day critical vulnerability in Log4j2 exploited in the wild". Business Insights. Bitdefender.

bloomberg.com

"Inside the Race to Fix a Potentially Disastrous Software Flaw". Bloomberg.com. 13 December 2021. Retrieved 19 November 2024.
"Inside the Race to Fix a Potentially Disastrous Software Flaw". Bloomberg.com. 13 December 2021.

bostonglobe.com

Bray, Hiawatha (15 December 2021). "Emerging 'Log4j' software bug spawns worldwide worry over cyber attacks - The Boston Globe". The Boston Globe. Retrieved 17 December 2021.

bund.de

bsi.bund.de

"Warnstufe Rot: Schwachstelle Log4Shell führt zu extrem kritischer Bedrohungslage" [Red alarm: Log4Shell vulnerability causes extremely critical threat situation] (Press release) (in German). Federal Office for Information Security. 11 December 2021.

cbc.ca

Cabrera, Holly (12 December 2021). "Facing cybersecurity threats, Quebec shuts down government websites for evaluation". CBC News. Retrieved 12 December 2021.

chasersystems.com

"Log4Shell and its traces in a network egress filter". Chaser Systems. 12 December 2021. Retrieved 18 January 2023.

checkpoint.com

blog.checkpoint.com

"The numbers behind a cyber pandemic – detailed dive". Check Point Software. 13 December 2021.

cisa.gov

"Review of the December 2021 Log4j Event" (PDF). Cyber Safety Review Board. 11 July 2022. Retrieved 18 January 2023.
"Statement from CISA Director Easterly on "Log4j" Vulnerability". CISA. 11 December 2021.

cloudflare.com

blog.cloudflare.com

Graham-Cumming, John (10 December 2021). "Inside the Log4j2 vulnerability (CVE-2021-44228)". The Cloudflare Blog. Retrieved 13 December 2021.
Gabor, Gabriel; Bluehs, Gabriel (10 December 2021). "CVE-2021-44228 - Log4j RCE 0-day mitigation". The Cloudflare Blog. Retrieved 13 December 2021.

computerweekly.com

"Almost half of networks probed for Log4Shell weaknesses". ComputerWeekly. 14 December 2021.

cyber.gc.ca

"Statement from the Minister of National Defence on Apache Vulnerability and Call to Canadian Organizations to Take Urgent Action". Government of Canada. 12 December 2021. Archived from the original on 20 December 2021. Retrieved 12 December 2021.

cyberkendra.com

"Worst Apache Log4j RCE Zero day Dropped on Internet". Cyber Kendra. 9 December 2021. Retrieved 12 December 2021.

danielmiessler.com

Miessler, Daniel (13 December 2021). "The log4j (Log4Shell) Situation". Unsupervised Learning.

doi.org

Sermersheim, J. (June 2006). Lightweight Directory Access Protocol (LDAP): The Protocol. International Electronic Task Force. doi:10.17487/RFC4513. RFC rfc4511. Retrieved 13 December 2021.

dynatrace.com

Berger, Andreas (17 December 2021). "What is Log4Shell? The Log4j vulnerability explained (and what to do about it)". Dynatrace news. Apache issued a patch for CVE-2021-44228, version 2.15, on December 6. However, this patch left part of the vulnerability unfixed, resulting in CVE-2021-45046 and a second patch, version 2.16, released on December 13. Apache released a third patch, version 2.17, on December 17 to fix another related vulnerability, CVE-2021-45105.

ft.com

Murphy, Hannah (14 December 2021). "Hackers launch more than 1.2m attacks through Log4J flaw". Financial Times. Retrieved 17 December 2021.

ftc.gov

"FTC warns companies to remediate Log4j security vulnerability". Federal Trade Commission (FTC). 4 January 2022. Retrieved 6 January 2022.

github.com

"Restrict LDAP access via JNDI by rgoers #608". Log4j. 5 December 2021. Retrieved 12 December 2021 – via GitHub.
"NCSC-NL/log4shell". National Cyber Security Centre (Netherlands). Retrieved 14 December 2021 – via GitHub.

gizmodo.com

"After Log4j, Open-Source Software Is Now a National Security Issue". Gizmodo. Retrieved 16 January 2022.

greynoise.io

"Exploit activity for Apache Log4j vulnerability - CVE-2021-44228". Greynoise Research. 10 December 2021. Retrieved 14 December 2021.

ietf.org

datatracker.ietf.org

Sermersheim, J. (June 2006). Lightweight Directory Access Protocol (LDAP): The Protocol. International Electronic Task Force. doi:10.17487/RFC4513. RFC rfc4511. Retrieved 13 December 2021.

jfrog.com

Menashe, Shachar (13 December 2021). "Log4Shell 0-Day Vulnerability: All You Need To Know". JFrog Blog. Retrieved 13 December 2021.

juniper.net

blogs.juniper.net

Hahad, Mounir (12 December 2021). "Apache Log4j Vulnerability CVE-2021-44228 Raises widespread Concerns". Retrieved 12 December 2021.

lunasec.io

Wortley, Free; Thrompson, Chris; Allison, Forrest (9 December 2021). "Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package". LunaSec. Archived from the original on 16 June 2024. Retrieved 16 June 2024.
"Guide: How To Detect and Mitigate the Log4Shell Vulnerability (CVE-2021-44228)". www.lunasec.io. 13 December 2021. Retrieved 13 December 2021.

mcafee.com

Povolny, Steve; McKee, Douglas (10 December 2021). "Log4Shell Vulnerability is the Coal in our Stocking for 2021". McAfee. Retrieved 12 December 2021.

minecraft.net

help.minecraft.net

"Security Vulnerability in Minecraft: Java Edition". Minecraft. Mojang Studios. Retrieved 13 December 2021.

mitre.org

cve.mitre.org

"CVE-2021-44228". Common Vulnerabilities and Exposures. Retrieved 12 December 2021.
"CVE-2021-45046". Common Vulnerabilities and Exposures. 15 December 2021. Retrieved 15 December 2021.

nccgroup.com

"Apache Log4j Zero Day Recommendations & Resources". NCC Group. Retrieved 18 January 2023.

ncsc.gov.uk

"Alert: Apache Log4j vulnerabilities". National Cyber Security Centre (United Kingdom). 10 December 2021. Retrieved 18 January 2023.

nist.gov

nvd.nist.gov

"CVE-2021-45105". National Vulnerability Database. Retrieved 4 January 2022.
"CVE-2021-44832". National Vulnerability Database. Retrieved 4 January 2022.

oracle.com

"Java(TM) SE Development Kit 8, Update 121 (JDK 8u121) Release Notes". Oracle. 17 January 2017. Retrieved 13 December 2021.

paloaltonetworks.com

unit42.paloaltonetworks.com

Yan, Tao; Deng, Qi; Zhang, Haozhe; Fu, Yu; Grunzweig, Josh (10 December 2021). "Another Apache Log4j Vulnerability Is Actively Exploited in the Wild (CVE-2021-44228)". Unit 42. Palo Alto Networks.

pcmag.com

Mott, Nathaniel (10 December 2021). "Countless Servers Are Vulnerable to Apache Log4j Zero-Day Exploit". PC Magazine. Retrieved 12 December 2021.

rapid7.com

Rudis, boB (10 December 2021). "Widespread Exploitation of Critical Remote Code Execution in Apache Log4j | Rapid7 Blog". Rapid7.

scmp.com

"Apache Log4j bug: China's industry ministry pulls support from Alibaba Cloud for not reporting flaw to government first". 22 December 2021.

sophos.com

nakedsecurity.sophos.com

Ducklin, Paul (12 December 2021). "Log4Shell explained – how it works, why you need to know, and how to fix it". Naked Security. Sophos. Retrieved 12 December 2021.

tagesschau.de

Sauerwein, Jörg (12 December 2021). "BSI warnt vor Sicherheitslücke". Tagesschau (in German).

tenable.com

Narang, Satnam (10 December 2021). "CVE-2021-44228: Proof-of-Concept for Critical Apache Log4j Remote Code Execution Vulnerability Available (Log4Shell)". Tenable Blog. Retrieved 14 December 2021.

thehill.com

Byrnes, Jesse (14 December 2021). "Hillicon Valley — Apache vulnerability sets off alarm bells". TheHill. Retrieved 17 December 2021.

thenewstack.io

J. Vaughan-Nichols, Steven (14 December 2021). "Log4Shell: We Are in So Much Trouble". The New Stack.

trendmicro.com

Duraishamy, Ranga; Verma, Ashish; Ang, Miguel Carlo (13 December 2021). "Patch Now Apache Log4j Vulnerability Called Log4Shell Actively Exploited". Trend Micro. Retrieved 14 December 2021.

usatoday.com

Woodyard, Chris. "'Critical vulnerability': Smaller firms may find it harder to stop hackers from exploiting Log4j flaw". USA Today. Retrieved 17 December 2021.

veracode.com

"Exploiting JNDI Injections in Java". Veracode. 3 January 2019. Retrieved 15 December 2021.

washingtonpost.com

Hunter, Tatum; de Vynck, Gerrit (20 December 2021). "The 'most serious' security breach ever is unfolding right now. Here's what you need to know". The Washington Post.

web.archive.org

Wortley, Free; Thrompson, Chris; Allison, Forrest (9 December 2021). "Log4Shell: RCE 0-day exploit found in log4j 2, a popular Java logging package". LunaSec. Archived from the original on 16 June 2024. Retrieved 16 June 2024.
"Statement from the Minister of National Defence on Apache Vulnerability and Call to Canadian Organizations to Take Urgent Action". Government of Canada. 12 December 2021. Archived from the original on 20 December 2021. Retrieved 12 December 2021.
Stupp, Catherine (21 December 2021). "Hackers Exploit Log4j Flaw at Belgian Defense Ministry". The Wall Street Journal. Archived from the original on 7 February 2022. Retrieved 14 February 2022.{{cite web}}: CS1 maint: bot: original URL status unknown (link)

wired.com

Newman, Lily Hay (10 December 2021). "'The Internet Is on Fire'". Wired. ISSN 1059-1028. Retrieved 12 December 2021.
Barrett, Brian. "The Next Wave of Log4J Attacks Will Be Brutal". Wired. ISSN 1059-1028. Retrieved 17 December 2021.

wiz.io

"Enterprises halfway through patching Log4Shell | Wiz Blog". www.wiz.io. 20 December 2021. Retrieved 20 December 2021.

worldcat.org

search.worldcat.org

Newman, Lily Hay (10 December 2021). "'The Internet Is on Fire'". Wired. ISSN 1059-1028. Retrieved 12 December 2021.
Barrett, Brian. "The Next Wave of Log4J Attacks Will Be Brutal". Wired. ISSN 1059-1028. Retrieved 17 December 2021.

wsj.com

Rundle, David Uberti and James (15 December 2021). "What Is the Log4j Vulnerability?". Wall Street Journal – via www.wsj.com.

zdnet.com

Greig, Jonathan (14 December 2021). "Second Log4j vulnerability discovered, patch already released". ZDNet. Retrieved 17 December 2021.
Duckett, Chris. "Log4j RCE activity began on 1 December as botnets start using vulnerability". ZDNet. Retrieved 13 December 2021.
Greig, Jonathan. "After Log4j, White House fears the next big open source vulnerability". ZDNet. Retrieved 16 January 2022.
Tung, Liam. "Log4j flaw attack levels remain high, Microsoft warns". ZDNet. Retrieved 5 January 2022.