So Apache dropped Log4j 2.17.1 yesterday. Fourth one. I want that on the record because by the time anyone reads this the whole saga is probably going to get flattened down to "there was a log4j thing in December 2021" and I need someone to remember there were FOUR of these.
Quick timeline because I had to write it out on a sticky note myself to keep it straight: 2.15.0 came out December 10th for the original Log4Shell mess (CVE-2021-44228, the one that made every security Twitter account lose its mind). Then 2.16.0 on the 13th because it turned out 2.15.0 didn't actually close the hole all the way and there was a denial-of-service angle too (CVE-2021-45046). Then 2.17.0 on the 17th for another DoS issue (CVE-2021-45105). And now, December 28th, 2.17.1, patching CVE-2021-44832, which is a remote code execution bug in the JDBC Appender that needs an attacker to already control your logging config to actually pull off.
That last part is what's got me a little annoyed, honestly. The severity on this one is way lower than the original (you basically need write access to the config already, at which point you've got bigger problems than log4j) and yet it still meant another emergency ticket, another "we need this deployed before end of day" message, another round of scanning every repo for the string "log4j" like we're all doing some kind of archaeology. I get why they patched it. I get why we deployed it. I'm just tired.
I'd cleared my whole week off between Christmas and New Year's. Had actual plans: was going to finally get through the stack of books next to my bed, maybe drive up and see my parents on the 30th. Instead I spent Tuesday morning at the kitchen table with my laptop open next to a plate of leftover ham, running dependency checks across three different services because nobody was totally sure which ones were still pinned to the vulnerable 2.14 branch. Found one. An internal reporting tool nobody had touched since March. Of course.
The thing that gets me about this whole month is how it just kept not being over. Log4Shell hit on the 9th/10th and every writeup, including probably some of the ones I would've linked here, had this tone of "okay, patch and move on." And then it wasn't move-on, it was patch again in three days. And again in four. And again a week and a half after that. If you work anywhere near infrastructure or security you basically lost the back half of December to this, on top of whatever holiday stuff you had going.
Separately, and I promise this is related only in the sense that it also ruined people's last week of December: if you were trying to fly anywhere over Christmas you probably already know it was a mess, thousands of flights got scrubbed because airline crews were testing positive and calling out sick. My cousin was stuck in Denver for two extra days because of it. Different kind of chaos, same general vibe of 2021 just refusing to let go cleanly.
Anyway. If you're running anything on Log4j, and at this point almost everyone touching Java is running something on Log4j whether they know it or not, get to 2.17.1. Don't wait for a fifth one, though at this rate I wouldn't bet against it. I've stopped being surprised by anything with a 2.1x.x version number this month.
I don't really have a neat way to close this out. I'm going to go finish that ham.