⬇ Download holy card: ·
Saint Log4Shell, Martyr of JNDI
Patron of sysadmins recalled to duty on weekends, logs that execute what they read, and everyone who didn't know they had Java at home.
Life
Born in a logging library nobody remembered installing, he revealed himself to the world on 9 December 2021 in a Minecraft chat line. It was enough to write his name between ${ } for half the planet's servers to welcome him, query him over LDAP and hand over the keys to the house.
Prayer
O Saint Log4Shell, who enters through every text field, keep our user-agents strings and never lookups. Deliver us from JNDI and from transitive dependencies. Amen.
How to celebrate
Celebrated by upgrading Log4j to 2.17.1, grepping every fat JAR in the datacenter, and spending Christmas building a software bill of materials.
Log4Shell's day brings no rest: if JNDI's open, the attacker's a guest.