Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Log4Shell is the name commonly used for CVE-2021-44228, a remote-code-execution vulnerability in Apache Log4j 2. Protecting an application means finding whether it contains the affected log4j-core component, updating affected software through current Apache or vendor-supported releases, and separately investigating whether vulnerable systems were exposed or compromised.
What is the Log4j vulnerability?
Log4j is a Java logging library maintained by Apache. Log4Shell, CVE-2021-44228, affects the Log4j 2 core component. In the vulnerable conditions described by NIST, an attacker could supply a log message or parameter that triggered JNDI lookup behavior and potentially caused code to be loaded from an attacker-controlled LDAP or other JNDI endpoint. See the NIST National Vulnerability Database record for CVE-2021-44228 for the precise technical description and scope.
As an Amazon Associate I earn from qualifying purchases.
This is not a vulnerability in every product called Log4j, nor in every Apache logging project. NIST identifies the affected component as log4j-core; using log4j-api alone is not affected by this CVE. The NVD record describes affected Log4j 2 versions from 2.0-beta9 through 2.15.0, with specified security-release exclusions. Check that record rather than relying on a simplified version range.
How to tell whether your application uses Log4j
An application may include Log4j indirectly or bundle it inside a product, so its name or top-level dependency list may not reveal exposure. Check each Java application and deployed artifact, including transitive dependencies, containers, appliances, and vendor products. When a product hides or manages its dependencies, use the vendor’s security notice or ask the vendor to confirm whether the affected component is present and whether a fixed release is available.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Inventory applications and services running Java, including production and non-production deployments.
- Inspect dependency manifests, build files, software composition or package inventories, and the contents of deployable artifacts and container images.
- Account for shaded, bundled, or otherwise embedded libraries that may not appear as a separate package.
- Check vendor advisories for commercial software and appliances that package their own runtime or libraries.
CISA’s joint Log4Shell and Log4j-related vulnerability guidance emphasizes maintaining a comprehensive asset inventory and identifying potentially vulnerable assets. A scanner can help discover components, but a clean scan should not replace vendor confirmation where packaging obscures the library.
How to protect applications from Log4Shell
1. Establish the affected products and versions
Compare discovered Log4j components and versions with the NVD’s CVE record, Apache’s live Log4j security advisories, and each affected product vendor’s notice. Apache’s security page includes later Log4j disclosures as well as CVE-2021-44228, so resolving this one CVE does not establish that a component is free of all other vulnerabilities.
2. Update through the supported channel
Upgrade affected software using a current vendor-supported package or product release that addresses the relevant advisories. For an application you maintain, update the vulnerable dependency and rebuild and redeploy the artifact. For a third-party product, apply its vendor’s fixed release and follow its instructions. Do not assume that updating Java by itself updates a bundled Log4j library.
Recommended Free Tools
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not use emergency version instructions from 2021 as universal advice today. Fixes were released in stages, and subsequent related issues were disclosed. The right target depends on the exact Log4j release, runtime, product, and current support status. Consult Apache’s current security page, its Log4j 2 release notes, and the vendor notice before selecting a version.
3. Use temporary mitigations only when necessary
If no supported update is available yet, follow a mitigation explicitly provided for that product and version by its vendor or Apache. Treat it as temporary, record the affected systems and change, and plan to move to a supported fix. CISA’s advisory, last revised December 23, 2021, described workarounds as temporary and cautioned that they could be incomplete or disruptive; its dated emergency steps should not be treated as current universal remediation.
4. Isolate when exposure cannot be safely controlled
For a known or suspected vulnerable asset that cannot promptly be updated or safely mitigated, assess whether to isolate it while remediation and verification proceed. Weigh the service impact and business criticality against the exposure, and coordinate the change with incident responders and system owners. CISA’s guidance recommends appropriate isolation of known or suspected vulnerable assets.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Verify and retain the record
After deployment, verify the actual running software and its dependency contents—not just the source manifest or intended package version. Record the product, affected component, version before and after, vendor advisory followed, deployment status, and any remaining mitigation. Repeat inventory checks as systems and vendor advisories change.
How to investigate possible exploitation
Finding and fixing vulnerable software answers whether an asset was susceptible; it does not answer whether anyone exploited it. If a system was internet-accessible while vulnerable, or there are other signs of suspicious activity, handle the situation as a potential security incident as well as a patching task.
- Preserve relevant logs and system evidence, following your incident-response procedures.
- Hunt for indicators and suspicious activity using current agency, Apache, and vendor guidance applicable to the affected product.
- Review relevant accounts, access, and configuration changes for unauthorized activity.
- Isolate known or suspected vulnerable assets as appropriate while they are investigated, mitigated, and verified.
- Escalate to your security or incident-response team; follow applicable organizational and regulatory reporting requirements.
CISA’s joint advisory recommends investigating potential exploitation and compromise, including suspicious account and configuration changes. A successful update prevents continued exposure to the addressed vulnerability, but it cannot establish that an earlier compromise did not occur.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choosing an operational response
| Situation | Response | What to weigh |
|---|---|---|
| A supported fixed product release is available | Update through the application’s or vendor’s supported package. | Confirm the release addresses the relevant advisory, then verify the running deployment. |
| No supported update is available yet | Apply a product-specific temporary mitigation if the vendor or Apache provides one. | Mitigations may be incomplete, temporary, or disruptive; track the affected assets and move to a supported update when available. |
| A known or suspected vulnerable asset cannot be adequately controlled | Consider isolating it while exposure is resolved and remediation is verified. | Balance service impact and operational criticality against security risk, with incident-response and system-owner input. |
Common mistakes to avoid
- Checking only direct dependencies: transitive and bundled copies can be missed.
- Checking only the application’s own code: vendor products, containers, appliances, and embedded runtimes may include the component.
- Updating Java but not Log4j: the vulnerable library may remain bundled with the application.
- Stopping after applying a workaround: a workaround is not a substitute for a supported update when one is available.
- Assuming remediation proves there was no compromise: assess possible past exploitation separately.
- Relying on a 2021 version number as today’s target: follow live Apache and exact product-vendor notices.
Or skip the browser setup
For a separate task—capturing a website screenshot—ScreenshotNeo offers a one-request API; it is not a Log4j scanner or remediation tool. For example, a cURL request can save a screenshot of a page:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo API documentation for request options. ScreenshotNeo accepts cookie or consent banners and removes more than 60 known consent platforms, newsletter popups, and chat widgets before capture; these steps can be turned off. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and responses include page-verdict and billing headers. An MCP server offers screenshot tools for AI clients, and the free plan includes 1,000 shots per month with no card; paid plans start at $5 for 3,000 shots. Sign up for ScreenshotNeo’s free plan.
For Log4j risk, use a software inventory or security-scanning process to discover dependencies, then validate findings against Apache and vendor notices; ScreenshotNeo does not perform that job.
Frequently Asked Questions
Does Log4Shell affect Log4j API by itself?
No. NIST identifies log4j-core as the affected component and says log4j-api alone is not affected by CVE-2021-44228.
Does updating Log4j prove an application was not compromised?
No. Updating addresses vulnerable software; systems that may have been exposed still need a separate investigation for possible exploitation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
