Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

log4j jar files for scan

See original GitHub issue

I got one old log4j jar file for scan test

I downloaded the scan tool locally.

$ docker run -ti --rm --entrypoint=bash -v $(pwd):/apps -w /apps birdyman/log4j2-demo:1.0.0-12
# ./log4j2-scan /project

[*] Found CVE-2021-44228 vulnerability in /project/log4j2-demo-1.0.0-12.jar (BOOT-INF/lib/log4j-core-2.10.0.jar), log4j 2.10.0
Scanned 1 directories and 1 files
Found 1 vulnerable files
Completed in 0.44 seconds

and I copy it out to some VMs, that my support team can report to me which instance got catched.

log4j2-demo-1.0.0-12.jar.tar.gz

could you provide more sample for me?

I need one that is good, with log4j 2.16, especially I need very old version as log4j 1.x.

Issue Analytics

State:
Created 2 years ago
Comments:9 (5 by maintainers)

Top GitHub Comments

2reactions

ChKempercommented, Dec 16, 2021

Hi @ozbillwang,

in my test file you can find som: loggingBuddies.zip.

2reactions

ChKempercommented, Dec 16, 2021

As I knew this scanner should only detect log4j2 version. For out company i have created a version which detects log4j 1.2 as “POTENTIALLY_VULNERABLE” when the JMSAppender class is in the JAR. The output is:

[?] Found CVE-2021-4104 (log4j 1.2) vulnerability in /Users/xgadkem/Downloads/log4j/log4j-1.2.17.jar, log4j 1.2.17

If voted, etc. I can provide a PR.

Top Results From Across the Web

How to Scan for Vulnerable Log4j Files - McCombs Tech Wiki

What to do if the scan finds vulnerable log4j files · Check with the vendor to see if there is an update that...

google/log4jscanner: A log4j vulnerability filesystem ... - GitHub

A log4j vulnerability filesystem scanner and Go package for analyzing JAR files. Installing. Pre-compiled binaries are available as release assets. To install ...

Use These Free, Publicly Available Log4j Scanning Tools

The firm says the tool performs a targeted search by scanning a given set of directories foe JAR, WAR, ZIP and EAR files,...

Using log4jscanwin to identify Log4j vulnerabilities ... - Kloudle

Use log4jscanwin, a tool created by Qualys, to scan Windows machines. The following steps will help identify the existence of vulnerable ...

How to Find Dangerous Log4j Libraries - The New Stack

java source files and compiled .jars. NCC Group RIFT log4j-finder is an open source Python scanner for log4j. It searches recursively both on ......