Analysis · Retrospective 2021
Log4Shell: the dependency inventory that patching could not replace
A retrospective on embedded Java dependencies, incomplete early fixes and the evidence needed to close a remediation ticket.
CVE-2021-45046
Technical coverage, source documents and official vulnerability records.
FISRO coverage
Read the relevant deployment conditions, remediation steps and limits of the evidence in the linked material.
Sources from this coverage
- Apache Logging Services security advisoriesApache Software Foundation
- Guidance for preventing, detecting, and hunting for Log4j 2 exploitationMicrosoft Threat Intelligence
- Microsoft's Response to CVE-2021-44228 Apache Log4j 2Microsoft Security Response Center