RCE 0-day exploit found in log4j, a popular Java logging package

• Apache Log4j 2

  108 3,276 9.9 Java

  Apache Log4j 2 is a versatile, feature-rich, efficient logging API and backend for Java.

  

See https://github.com/apache/logging-log4j2/pull/597/files (which was recently merged). Also the error this PR is fixing is so incredibly amateurish that it's hard to to feel disgust.

• ysoserial

  13 7,327 4.6 Java

  A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

This has been known for a zillion years and has caused a zillion CBEs, so at this point there are off-the-shelf tools like ysoserial that take your payload and wrap it into an object that kabooms when deserialized, with like 20 different choices of methods depending on what dangerous objects are available on the target's classpath for deserialization.

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• coq

  87 4,616 10.0 OCaml

  Coq is a formal proof management system. It provides a formal language to write mathematical definitions, executable algorithms and theorems together with an environment for semi-interactive development of machine-checked proofs.

  

Regarding something constructive, Cubical Type Theory is far more advanced than required for all software development humanity has ever attempted. Using Coq works for industry level tasks just fine, even without https://github.com/coq/coq/issues/13544.

• Log4jPatcher

  2 46 0.0 Java

  A mitigation for CVE-2021-44228 (log4shell) that works by patching the vulnerability at runtime. (Works with any vulnerable java software, tested with java 6 and newer)

  

The folks over at CreeperHost have created a Java agent that patches log4j2, for people who can't update it for whatever reason. https://github.com/CreeperHost/Log4jPatcher

• Doubly-Linked-List-VST

  1 2 10.0 Coq

  Discontinued The final project for CS2603 (2021 Spring), aiming to verify a doubly linked list library using VST. Collaborating with @karzexcc

• Log4jAttackSurface

  40 2,085 0.0

• Logback

  20 2,900 8.9 Java

  The reliable, generic, fast and flexible logging framework for Java.

  

Also https://github.com/qos-ch/logback/commit/b810c115e363081afc70f8bf4ee535318c3a34e1

• SaaSHub

  www.saashub.com featured

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

• Spring Boot

  167 72,961 10.0 Java

  Spring Boot

  

Suggest a related project