Skip to content
This repository has been archived by the owner on Jun 30, 2023. It is now read-only.

Scan does not catch log4j log4j-1.2.12.jar #55

Open
vitikyalapatii opened this issue Jan 28, 2022 · 0 comments
Open

Scan does not catch log4j log4j-1.2.12.jar #55

vitikyalapatii opened this issue Jan 28, 2022 · 0 comments

Comments

@vitikyalapatii
Copy link

The log4j scanner does not seem to catch log4j-1.2.12.jar ( which is obviously vulnerable )

There is this other scanner that i used, was able to accurately mark this version of log4j jar as vulnerable
Scanner Used: https://github.com/hillu/local-log4j-vuln-scanner/releases/tag/v0.13

./local-log4j-vuln-scanner.macosx --quiet /Users/hillu-log4j-scanner-test/
Checking for vulnerabilities: CVE-2019-17571, CVE-2021-44228, CVE-2021-45105
indicator for vulnerable component found in /Users/hillu-log4j-scanner-test/log4j-1.2.12.jar (org/apache/log4j/net/SocketNode.class): SocketNode.class log4j 1.2.12 CVE-2019-17571

Would it be possible to fix the scanner to catch this log4j/ any version that is less than 2.17.0 ?

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant