In the past few days information about a new vulnerability called "Log4Shell" (CVE-2021-44228) in the "log4j" component of many Java-based applications has been released. The vulnerability is extremely critical (CVSS score of 10.0) as a remote attacker can compromise a vulnerable system with very little effort.
Every administrator has to check, if the vulnerable component is used by their service or system. In case a vulnerable version of log4j is used, it has to be updated immediately or a workaround has to be used. To check whether log4j is being used one can search for the related JAR-files ("log4j*.jar"). Especially if the service or system is publically available, the sytem should be checked for signs of compromise!
All versions of log4j between 1.0 and 2.14.1 are vulnerable.
In versions 1.x, the vulnerability is only exploitable via a malicious program configuration, which is why the probability of exploitation is considered lower.
