log4j-finder icon indicating copy to clipboard operation
log4j-finder copied to clipboard

Published 20 hours ago • verified publisher icon fox-it

Missing 'known bad' hash for versions <2.1?

Open sonotley opened this issue 3 years ago • 2 comments

Unless I have misunderstood, this vulnerability affects all versions of log4j from 2.0-beta9 to 2.14.1. I have scanned a directory that contains 2.0.2 and it didn't show up, presumably as there isn't a hash for it. I can supply a hash or a PR if needed.

sonotley avatar Dec 21 '21 20:12 sonotley

Hi thanks for reporting! it looks like JndiManager.class is not in these versions so it does not show up. We will need to improve our version detection based on other things as well, such as parsing package metadata and hash other classes, etc.

I already started some refactoring based on #51

yunzheng avatar Dec 22 '21 08:12 yunzheng

Thanks for reply. Based on the info I've read online, the source of the vulnerability is jndiFilter.class, which does exist in 2.0.2.

sonotley avatar Dec 22 '21 16:12 sonotley