Comments (5)
I'd recommend to add a command line flag to disable log4j 1.x artifacts.
They are not vulnerable per se, as it requires special config to make it vulnerable (custom appender config). If you flag log4j 1.x, you also need to flag any other code that can optionally make JNDI connections. CVE-2019-17571 describes an old problem in the old log4j version, which can only be enabled by custom configuration, too. "standard use of log4j" (writing log files) is not risky.
The problem is only log4j2, which in its default configuration reacts to ${jndi:...}
from local-log4j-vuln-scanner.
@uschindler well said and agreed.
@hillu any chance we could have the flag added?
from local-log4j-vuln-scanner.
Sure. Would yyou like to do a pull request?
from local-log4j-vuln-scanner.
PR is there (#14) but it needs a bit of refinement.
from local-log4j-vuln-scanner.
Thanks. Naming of parameter is a bit strange, maybe --no-v1
would habe been better.
from local-log4j-vuln-scanner.
Related Issues (20)
- command line option for jar file matching HOT 7
- Misnamed executable for patching HOT 1
- Can't read magic from JAR file member HOT 1
- Detection flags jar files with JndiLookup.class removed (but JndiManager.class present) HOT 8
- Treat 2.12.2 as fixed version
- New magic number check failure HOT 2
- Strange "indicator" message from scanner HOT 1
- Patcher does not seem to fix WAR files HOT 1
- apache log4j 2.17 already out, please add HOT 1
- Even with exclude, tool scans folders HOT 4
- CVE-2021-45105 should mark 2.16 as vulnerable HOT 4
- How to use filter.go HOT 4
- Feature request: -exclude with wildcards HOT 1
- Just curious - why do you do f.Seek(0, END) twice? HOT 1
- Scans network shares on macOS HOT 9
- Unable to scan network filesystems HOT 5
- x86 support? HOT 3
- installation with go install HOT 2
- Crash when jar file is zero bytes HOT 2
- Virustotal 2 security vendors and no sandboxes flagged this file as malicious HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from local-log4j-vuln-scanner.