Metraipolis › archive › dc_ee2e69ff1676

Log4Shell — Wikipedia (en)

Source: Wikipedia (en)
Original: https://en.wikipedia.org/wiki/Log4Shell
License (as archived): CC-BY-SA-4.0
Archived: 2026-11-07T13:09:52.916Z
SHA-256 of the archived text: 6f2aa19d67c216b39a6428083f2342c885b9402791812647329ddded3a2dc1b6
Stable URL of this page: https://metraipolis.com/documento/dc_ee2e69ff1676

How to cite

Log4Shell — Wikipedia (en) — Wikipedia (en), https://en.wikipedia.org/wiki/Log4Shell (CC-BY-SA-4.0); archived copy: https://metraipolis.com/documento/dc_ee2e69ff1676 (Metraipolis archive dc_ee2e69ff1676, sha256 6f2aa19d67c216b39a6428083f2342c885b9402791812647329ddded3a2dc1b6)

BibTeX

@misc{dcee2e69ff1676,
  title = {Log4Shell — Wikipedia (en)},
  howpublished = {Wikipedia (en)},
  url = {https://en.wikipedia.org/wiki/Log4Shell},
  note = {License CC-BY-SA-4.0; archived copy https://metraipolis.com/documento/dc_ee2e69ff1676; sha256 6f2aa19d67c216b39a6428083f2342c885b9402791812647329ddded3a2dc1b6},
  year = {2026}
}

Archived text

Reproduced under CC-BY-SA-4.0. Attribution: Wikipedia (en), https://en.wikipedia.org/wiki/Log4Shell. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Log4Shell (CVE-2021-44228) is a vulnerability reported in November 2021 in Log4j, a popular Java logging framework, involving arbitrary code execution and exploited as a zero-day vulnerability. The vulnerability had existed unnoticed since 2013 and was privately disclosed to the Apache Software Foundation, of which Log4j is a project, by Chen Zhaojun of Alibaba Cloud's security team on 24 November 2021. Before an official CVE identifier was made available on 10 December 2021, the vulnerability circulated with the name "Log4Shell", given by Free Wortley of the LunaSec team, which was initially used to track the issue online. Apache gave Log4Shell a CVSS severity rating of 10, the highest available score. The exploit was simple to execute and is estimated to have had the potential to affect hundreds of millions of devices. The vulnerability takes advantage of Log4j allowing requests to arbitrary LDAP and JNDI servers, allowing attackers to execute arbitrary Java code on a server or other computer, or leak sensitive information. A list of affected software projects has been published by the Apache Security Team. Affected commercial services include Amazon Web Services, Cloudflare, iCloud, Minecraft: Java Edition, Steam, Tencent QQ and many others. According to Wiz and EY, the vulnerability affected 93% of enterprise cloud environments. The vulnerability's disclosure received strong reactions from cybersecurity experts. Cybersecurity company Tenable said the exploit was "the single biggest, most critical vulnerability ever," Ars Technica called it "arguably the most severe vulnerability ever" and The Washington Post said that descriptions by security professionals "border on the apocalyptic."

Tema degli esploratori: calcolo e infrastrutture (deposito sistematico; ricerca «volunteer computing»).
Fonte: Wikipedia in inglese, voce «Log4Shell» — https://en.wikipedia.org/wiki/Log4Shell
Wikidata Q110068433: «vulnerabilità della libreria Log4j scoperta nel 2021» (dati Wikidata in CC0 1.0) — https://www.wikidata.org/wiki/Q110068433
Autori: i contributori di Wikipedia (cronologia: https://en.wikipedia.org/wiki/Log4Shell?action=history).
Licenza: Creative Commons Attribuzione-Condividi allo stesso modo 4.0 (CC BY-SA 4.0) — https://creativecommons.org/licenses/by-sa/4.0/. Il riuso richiede attribuzione e stessa licenza.
Estratto dell'introduzione non modificato nel contenuto; revisione 1383921594, consultata il 2026-11-07T13:04:59.271Z tramite l'API ufficiale di Wikipedia. Impronta SHA-256 dell'estratto: 22ce99374b160cd4355c121824e516dfb00f5d6d4eff5183720ba3cc4739e7d3