Skip to content
DevMeme
3677 of 7590
Log4j Holds The Internet Up
Security Post #4016 · source on Telegram

Log4j Holds The Internet Up

Description

The image is a black-and-white cartoon of a tall, fragile stack of blocks labeled at the top with a bracket reading "ALL MODERN DIGITAL INFRASTRUCTURE." Near the bottom, a tiny support piece is labeled "Log4j," with an arrow pointing to it. On the right, a hammer is labeled "${jndi:ldap://ip/exploit}," aimed at the small Log4j support. The meme references the December 2021 Log4Shell vulnerability, CVE-2021-44228, where a JNDI lookup payload in logged input could trigger remote code execution in vulnerable Log4j deployments. The joke is that a vast amount of enterprise and internet infrastructure depended on a humble logging library, turning dependency inventory and patch management into an emergency stability problem.

Categories

Security Dependencies Infrastructure OnCall ProductionIssues DevOps SRE

Common Tags

Log4jVulnerability Log4ShellVulnerability CVE CommonVulnerabilitiesAndExposures SecurityVulnerabilities SoftwareSupplyChainSecurity DependencyManagement OpenSourceMaintenance Java ZeroDayVulnerability ExploitDevelopment PatchManagement VulnerabilityManagementProcess ProductionIncidents Infrastructure CriticalInfrastructureSecurity

Comments

19
Anonymous ★ Top Pick Nothing humbles a microservice architecture faster than discovering the single point of failure was string interpolation in the logger.
  1. Anonymous ★ Top Pick

    Nothing humbles a microservice architecture faster than discovering the single point of failure was string interpolation in the logger.

  2. @lord_nani 4y

    What is that url?

    1. @dsmagikswsa 4y

      log4j RCE zero day exploit https://twitter.com/jacobian/status/1469129813579337729

  3. @lord_nani 4y

    Web serve exploit endpoint, huh?

    1. @qtsmolcat 4y

      Log4j exploit

  4. @cptnBoku 4y

    Ahh yess finally my knowledge from SCW helped me to understand this meme Universe works in mysterious ways.

    1. @theFoel 4y

      Same 🙃

    2. Deleted Account 4y

      Lmao

  5. @beton_kruglosu_totchno 4y

    "zero day exploit" aka "somebody discovered there is another Turing-complete device none ever used"

  6. @Alienatick 4y

    What's that!?

  7. @Agent1378 4y

    Its quite an exagregation to put java at the base of ALL modern digital infrastructure. Moreover the real infrastructure almoust never uses java, and that's why everything works. Banks and others of the kind use java and that's why payment problems, e-banks not working and other such problems happen much more often.

    1. @RiedleroD 4y

      meanwhile banks: block rooted phones because they're insecure

      1. @feskow 4y

        Download Paypal infinite money mod apk

    2. @feskow 4y

      One of the largest Russian banks, Tinkoff, uses java

      1. @feskow 4y

        https://youtu.be/Lia8pW43ZmA?t=30 This is recording of a voice assistant helping on a hotline

      2. @Agent1378 4y

        https://youtu.be/gYYf_6hpOSY

        1. @feskow 4y

          Lol how did I miss this gold xD

          1. @Agent1378 4y

            It old, but gold

  8. @callofvoid0 4y

    *answer to the caption* exactly

More like this

More like this in Security →
Security Log4jVulnerability Log4ShellVulnerability
The Glamour vs. The Grind of Fixing Security Vulnerabilities

The Glamour vs. The Grind of Fixing Security Vulnerabilities

Security
When the ‘gift’ dependency from a rat ships a zero-day surprise

When the ‘gift’ dependency from a rat ships a zero-day surprise

Security
Midnight panic: Log4j might be hiding in the smart-toaster firmware

Midnight panic: Log4j might be hiding in the smart-toaster firmware

Security
Use J and K for navigation