codeshield-security / log4jshell-bytecode-detector Goto Github PK
View Code? Open in Web Editor NEWLocal Bytecode Scanner for the Log4JShell Vulnerability (CVE-2021-44228)
Home Page: https://codeshield.io
License: MIT License
Local Bytecode Scanner for the Log4JShell Vulnerability (CVE-2021-44228)
Home Page: https://codeshield.io
License: MIT License
A known bad jar is the newrelic java agent 7.4.0 using log4j 2.11.2
https://download.newrelic.com/newrelic/java-agent/newrelic-agent/7.4.0/
Analysing newrelic-agent-7.4.0.jar
Jar file not affected by CVE-2021-44228!
Dear Andreas, all,
Great tool, thank you for taking this initiative!
I just had a quick look at VulnerableGavs.csv
and noticed that groupId and artifactId are confused for some of the GAVs (e.g. io.apiman:apiman-gateway-platforms-vertx3
).
Also, I wondered whether you think it is useful to add an additional column indicating whether the respective GAV declares a dependency on the original log4j-core, or whether it re-bundles the vulnerable code. The presence of a classifier may be an approximation, but does not cover all cases (e.g. org.ops4j.pax.logging:pax-logging-log4j2
re-bundles a vulnerable log4j-core version, but does not have a classifier).
Cheers, Henrik
After updating log4j2 version from 2.16.0 up to 2.17.0, detector reports that CVE-2021-44228 affected jar.
CVE-2021-44228 found declared as dependency in .../application-1.0.0/BOOT-INF/lib/log4j-core-2.17.0/org/apache/logging/log4j/core/appender/mom/JmsAppender$Builder.class
On log4j2 security page it is recommended to use 2.17.0 instead of 2.16.0 cause of CVE-2021-45105.
So the question is - is the 2.17.0 affected by CVE-2021-44228, or it is a detector defect?
We run and older version of exist-db, that we cannot easily update. The log4j-core.2.8.2.jar is flagged to have the vulnerability. However, when we run the processes analysis, then it finds Scanning jar file lib/log4j-1.2.14.jar which does not have the vulnerability. Does that mean the the 2.8.2 version files are not used?
If I download the latest Log4j core jar file from maven
https://repo1.maven.org/maven2/org/lucee/log4j-core/2.17.1/log4j-core-2.17.1.jar
and scan it, I get this message:
Analysing log4j-core-2.17.1.jar
CVE-2021-44228 found in class file D:\Downloads\log4j-core-2.17.1\org\apache\logging\log4j\core\util\NetUtils.class
Is the latest jar still vulnerable or is the scanner wrong? I'm using the latest Log4JDetector-0.7.2-jar-with-dependencies.jar
to scan.
Analysing lib\lucee-5.3.9.80-SNAPSHOT.jar
CVE-2021-44228 found in class file D:\ColdFusion2021\cbhome\lib\lucee-5.3.9.80-SNAPSHOT\bundles\org.lucee.log4j-core-2.17.1\org\apache\logging\log4j\core\util\NetUtils.class
Analysing lib\runwar-4.7.1-SNAPSHOT.jar
CVE-2021-44228 found in class file D:\ColdFusion2021\cbhome\lib\runwar-4.7.1-SNAPSHOT\org\apache\logging\log4j\core\util\NetUtils.class
Analysing engine\cfml\cli\lucee-server\bundles\org.lucee.log4j-core-2.17.1.jar
CVE-2021-44228 found in class file D:\ColdFusion2021\cbhome\engine\cfml\cli\lucee-server\bundles\org.lucee.log4j-core-2.17.1\org\apache\logging\log4j\core\util\NetUtils.class
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.