Apache · AUTOMATIC DISCOVERY
Apache Log4j is tracked by BlackTree as a software framework or development platform. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
This record passed BlackTree's automatic primary-source checks with a confidence score of 82. It is returned for operational research without requiring routine manual approval. Confirm edition and deployment applicability before acting.
This discovery does not establish a product-specific support or retirement date. A missing date does not mean support continues.
Apache Log4j is tracked by BlackTree as a software framework or development platform. Its lifecycle page separates release identity, maintenance and security boundaries using the publisher's registered source.
Used by software teams to build, run or maintain applications.
Included in source projects, application dependencies, build systems or managed runtimes.
This category-level context is generated from the registered product identity. Confirm exact product capabilities on the publisher's page .
| Product | Apache Log4j |
|---|---|
| Release | Lifecycle policy |
| Start or release | Not extracted |
| Lifecycle boundary | Continuous or not dated in the source |
| Date precision | Unknown |
These are product-family matches in the CISA Known Exploited Vulnerabilities catalogue. Confirm the affected product version in the vendor advisory.
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
CISA entryApache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
CISA entryOSV advisories are matched through the registered package URL. A package-family match does not prove that the installed release is affected. Check the affected and fixed versions before remediation.
Log4cxx, Log4j and Log4net must prevent log injection in structured layouts, such as the XML, JSON, RFC 5424, and HTML layouts, when they are consumed by a passive sink; see Passive and active sinks . | Apache Logging Services projects do check the quality of our dependencies. | Apache Logging Services projects do check the quality of our dependencies. | Deprecated components such as the Cassandra , Kafka and CouchDB appenders are provided for backward compatibility purposes only. While we actively check for vulnerabilities in those components, they are de facto unmaintained, and we discourage their usage in production. | Deprecated components such as the Cassandra , Kafka and CouchDB appenders are provided for backward compatibility purposes only. While we actively check for vulnerabilities in those components, they are de facto unmaintained, and we discourage their usage in production. | All Apache Logging Services are signed with one of the keys in the Logging Services PMC KEYS file . We do not support artifacts that do not have a valid signature, and we encourage users to always check the integrity of the downloaded components. Additional information on how to verify releases signatures is available on the Download page | All Apache Logging Services are signed with one of the keys in the Logging Services PMC KEYS file . We do not support artifacts that do not have a valid signature, and we encourage users to always check the integrity of the downloaded components. Additional information on how to verify releases signatures is available on the Download page
Publisher identity used by product-specific official-source collectors.
Open official vendor source