Flagging 1.X Versions about local-log4j-vuln-scanner

[uschindler]

I'd recommend to add a command line flag to disable log4j 1.x artifacts.

They are not vulnerable per se, as it requires special config to make it vulnerable (custom appender config). If you flag log4j 1.x, you also need to flag any other code that can optionally make JNDI connections. CVE-2019-17571 describes an old problem in the old log4j version, which can only be enabled by custom configuration, too. "standard use of log4j" (writing log files) is not risky.

The problem is only log4j2, which in its default configuration reacts to ${jndi:...}

[theonlykernel]

@uschindler well said and agreed.

@hillu any chance we could have the flag added?

[hillu]

Sure. Would yyou like to do a pull request?

[hillu]

PR is there (#14) but it needs a bit of refinement.

[uschindler]

Thanks. Naming of parameter is a bit strange, maybe --no-v1 would habe been better.