corretto
Protection against Log4J 1.x CVEs
Add protection against CVE-2019-17571 and CVE-2021-4104
This agent is based on https://github.com/corretto/hotpatch-for-apache-log4j2 and extends the agent to be working with Log4J 1.x:
The CVE-2019-17571 --> (Log4j 1.2 is a SocketServer class that is vulnerable to deserialization) & CVE-2021-4104 --> (JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data) are patched by emptying the classes that are responsible for the RCE-Exploit. Thus any exploit attempt is rendered useless.
Java Applications containing vulnerable versions of the Log4J libraries that cannot be upgraded for any reason can be considered safe against the provided CVEs above.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
