fox-it/log4j-finder

Missing 'known bad' hash for versions <2.1?

sonotley opened this issue · 2 comments

sonotley commented

Unless I have misunderstood, this vulnerability affects all versions of log4j from 2.0-beta9 to 2.14.1. I have scanned a directory that contains 2.0.2 and it didn't show up, presumably as there isn't a hash for it. I can supply a hash or a PR if needed.

yunzheng commented

Hi thanks for reporting! it looks like JndiManager.class is not in these versions so it does not show up. We will need to improve our version detection based on other things as well, such as parsing package metadata and hash other classes, etc.

I already started some refactoring based on #51

sonotley commented

Thanks for reply. Based on the info I've read online, the source of the vulnerability is jndiFilter.class, which does exist in 2.0.2.