Log4Shell (2021) taught the industry which main lesson?
Options
- One dependency flaw can hit thousands: keep an SBOM (Correct option)
- Never use Java to build production software
- Logging is unsafe and should be disabled entirely
- Only the first-party code matters for security
Answer
A vulnerability in a popular transitive dependency can compromise thousands of apps, so you need an inventory of dependencies (SBOM), scanning and fast patching
Why
Log4Shell (CVE-2021-44228) was a critical remote code execution flaw in the Log4j logging library: logging an attacker-controlled string could make the app load and run remote code.
Many teams did not even know they used Log4j because it came as a transitive dependency.
Lessons: keep a Software Bill of Materials (SBOM), run SCA scans continuously, update dependencies regularly, and never trust input, even when it is just being logged.
Remember
Know your dependencies; patch fast; SBOM + SCA.