So much for a quiet week between Christmas and New Year's. I had exactly one item on my to-do list for December 28th (return a sweater that was two sizes too big) and instead I spent about four hours re-patching a Java service I run for a side project, because Log4j got its fourth fix of the month that day.
If you've been anywhere near a tech news site since December 9th you already know the broad strokes of Log4Shell, so I'm not going to re-explain the whole thing from scratch. What I want to actually lay out, mostly for my own sanity, is where things stand right now, because "just patch Log4j" has turned into a moving target and I don't think that's obvious if you haven't been following it hour by hour.
The patch history so far, near as I can tell:
- 2.15.0 (Dec 10th): the first fix for the original RCE, CVE-2021-44228. Turned out to be incomplete.
- 2.16.0 (Dec 13th): patched CVE-2021-45046, because 2.15.0 still left non-default configurations exploitable. This one also just ripped out message lookups entirely rather than trying to be clever about it.
- 2.17.0 (Dec 18th): fixed CVE-2021-45105, a denial-of-service bug involving uncontrolled recursion in self-referential lookups. Lower severity, but still not nothing if you're running anything public-facing.
- 2.17.1 (Dec 28th): the one that ruined my Tuesday. Fixes CVE-2021-44832, an RCE via the JDBC Appender, though this one requires an attacker to already have write access to your logging config, so it's a much smaller blast radius than the original.
Four CVEs, four point releases, nineteen days. I don't think I've ever watched a single dependency get this many emergency releases in this short a window, and I've been doing this since before this blog existed.
The part that actually ate my afternoon wasn't even the patching: bumping a version number in a pom.xml takes thirty seconds. It was going back through every place I'd deployed something with log4j-core anywhere in the dependency tree and checking which of the four versions it was on, because I'd patched some of these boxes on the 13th, one on the 18th, and apparently forgot about a small internal tool entirely until this week. Turns out "I'll fix it later" is a great way to end up doing four rounds of the same job instead of one.
My nephew's Minecraft server was the other casualty here, for what it's worth. He and his friends run a little Java-edition server that his dad set up, and it got swept into all of this because Minecraft: Java Edition uses Log4j for logging; Mojang and Microsoft ended up shipping their own emergency patches on top of the game itself, separate from anything server operators had to do. Explaining to an eleven-year-old why his server was down over winter break because of "a logging library" was a genuinely strange conversation to have.
If you're still catching up, here's what I'd actually check, in order:
- Find every jar with log4j-core in it.
find / -name 'log4j-core-*.jar'will get you most of the way there, though shaded/fat jars can hide it, you may need to grep inside jars too. - If you can't upgrade immediately, the emergency mitigation is still worth doing: strip the JndiLookup class out of the jar (
zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class) or set the system property to disable lookups. Neither is a substitute for actually upgrading, they just buy you time. - Go straight to 2.17.1. Don't stop at 2.16 or 2.17 thinking you're done, because apparently we are not done.
- Separately, if you've got old Log4j 1.x hanging around (different codebase, different vulnerabilities, its own mess), that's end-of-life and not getting fixed at all. Different problem, same shrug.
What's bugged me most this month isn't the vulnerability itself, it's how many vendor status pages just said some version of "we are aware and monitoring the situation" for days with zero actual detail about what versions they run or when they'd patch. If you can't tell me whether you're affected, I have to assume you are.
Anyway. I've still got two more internal services to check before I let myself pour a drink tonight, and then that's it, I'm done thinking about logging libraries for 2021. Happy New Year, everybody, see you on the other side of this patch treadmill.