4 ms·
Their scanner linked from their Mitigation Guide didn't work for me at all. I scanned a bunch of ear, war, and jar files that have log4j 2.x in them and it didn
by tbirdny 5y ago
Their scanner linked from their Mitigation Guide didn't work for me at all. I scanned a bunch of ear, war, and jar files that have log4j 2.x in them and it didn't find any of them. I guess for the reason described here:
https://github.com/lunasec-io/lunasec/issues/301 https://github.com/lunasec-io/lunasec/issues/301
This is less than helpful if people use this and then believe they are safe.
- flh 5y agoI had to deal with the opposite problem this week. My company uses Qualys for our vulnerability management stuff and after our security guys ran their scans throughout the network over the weekend we had a bunch of false positives. Seems that they were alerting on log4j-api in addition to log4j-core (only log4j-core is impacted per Apache). Looks like Qualys fixed it on Monday though so this shouldn't be a problem going forward if anyone else uses them. https://blog.qualys.com/vulnerabilities-threat-research/2021/12/10/apache-log4j2-zero-day-exploited-in-the-wild-log4shell https://blog.qualys.com/vulnerabilities-threat-research/2021...
- freeqaz 5y agoWe'll get on this tomorrow to help make this right. It's hard work dealing with all of the complexity that comes from parsing and patching Java packages! (that's part of the reason we wrote our exploit payload to patch a running Java service in-memory -- it was actually more straightforward than this tool. >.<)