search

google / log4jscanner

A log4j vulnerability filesystem scanner and Go package for analyzing JAR files.
Apache License 2.0
1.56k stars 121 forks source link

Report CVEs identified #60

Closed singlethink closed 2 years ago

singlethink commented 2 years ago

Updates jar.Parse to return the specific CVEs identified during the scan.

To ensure that refactoring of detection logic is correct, I've tested this on a corpus of all log4j2 releases through 2.16.0 and verified that there are no false positives or false negatives.