Comments (4)
Is the JMSAppender.class still vulnerable without the JndiLookup.class?
apache/logging-log4j2#608 (comment)
from log4jscanner.
from log4jscanner.
Yeah, it looks like this was the recommended remediation by a couple vendors. Thanks for bringing this up :)
Adding one of the jars from https://repo1.maven.org/maven2/log4j/log4j/1.2.17/ to our test data, it looks like we wouldn't find it as vulnerable, so it'd need different matching logic.
cc @ddworken
from log4jscanner.
Thank you for the feature request, but after discussing this we believe that this is out-of-scope for this tool. The goal of this tool is specifically to detect the critical RCE vulnerabilities affecting log4j 2.x that are broadly exploitable, and thus need to be urgently patched. CVE-2021-4104 only applies if an attacker has control over the log4j config, which I believe is not true in most cases. And it is even more unlikely that a completely unprivileged attacker would have this level of access. So while CVE-2021-4104 is an important vulnerability to patch, I don't think it is critical in that same way CVE-2021-44228 is.
If you need a general tool to search for vulnerable dependencies, I'd recommend investing in other solutions that check all dependencies, not just log4j dependencies. Though if you need this specific feature for your own use, you can of course always fork it to add it yourself, it shouldn't be too hard to add the relevant logic to jar.go
and rewrite.go
.
from log4jscanner.
Related Issues (20)
- readdir META-INF/versions/9: not implemented HOT 7
- Rewrite should back up the original jar(s) by default HOT 5
- Can it scan vulnerabilities of other log conpoments, such Logback and java.util.logging.Logger? HOT 2
- scanner fails if /tmp is on a different filesystem than the filesystem being scanned on linux HOT 2
- Support executable JARs HOT 1
- Dependency Error While Building
- Replace io.ReadAll usage with pre-allocated buffers of appropriate size HOT 3
- sudo: log4jscanner: command not found HOT 2
- "cannot find package" when building or installing through go install command HOT 1
- test flutter app issue
- Add Support for Additional Java Binary Types HOT 1
- Error scanning - negative offset HOT 3
- False positive with current detection method HOT 3
- release assets archives contain potentially dangerous "." folder
- Add install instructions
- False negative for old libraries version HOT 1
- Scan does not catch log4j log4j-1.2.12.jar
- Release precompiled binaries
- log4jscanner should be able to scan a single file
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from log4jscanner.