What is Log4j vulnerability?
The Log4j Vulnerability was first reported by Alibaba Cloud Security Team late in November 2021 and then was alerted to Apache Software Foundation Team which maintains the Log4j Library.
Log4j is a very popular Java-based Logging tool created by Ceki Gülcü. It's used by many enterprises like Apple, SalesForce, Oracle, Redhat, Cloudflare, Google. This vulnerability causes Remote Code Execution. Remote Code Execution(RCE) is a process in which the hackers inject malicious code into applications on servers and servers unknowingly execute those malicious codes. Remote Code Execution (RCE) is also referred to as Remote Code Evaluation.?
The Vulnerability has been classified as Very Critical. we can check the CVSS Score here which is 10/10.
Impacts of Remote Code Evaluation Vulnerability
Log4j Vulnerability Description
Fix for this vulnerability has been already released by Apache and we can find the details here.
领英推荐
What is Log4j?
Log4j is divided into three main components Loggers, Appenders and Layouts.
Loggers: This is responsible for capturing the logging information and passing it on to Appenders.
Appenders: This is responsible for publishing the logging data into file, Database, Console.
Layouts: This is responsible for the formatting of the log messages. Some default layouts provided by Log4j are PatternLayout, SimpleLayout, XMLLayout, HTMLLayout.
Log4j Demonstration:
import org.apache.logging.log4j.Logger
import org.apache.logging.log4j.LogManager;
public class Log4jExample {
private static Logger logger = LogManager.getLogger(Log4jExample.class);
public static void main(String[] args) {
logger.debug("Debug log message");
logger.info("Info log message");
logger.error("Error log message");
}
};
After we compile and execute this above code we get output as below
Debug log message
Info log message
Error log message
Thanks! :)