search

logpresso / CVE-2021-44228-Scanner

Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228
Apache License 2.0
850 stars 174 forks source link

provide binary for ARM / Raspberry #149

Closed doctore74 closed 2 years ago

doctore74 commented 2 years ago

It would be great if you could provide the scan binaries for ARM/Raspberry/MacOS as well.

jgstew commented 2 years ago

You can run the JAR without the binary as long as you have a JRE/JDK already installed.

Building the binaries is kind of a pain from my research without actually building it on the platform you wish to target.

With something like Python, I can actually build binaries for other platforms on a single platform, so that is much easier to automate.

I am looking into automatically building binaries on all platforms that github provides action runners for here: https://github.com/logpresso/CVE-2021-44228-Scanner/issues/133

I haven't had as much time to work on it as I would like yesterday and today, but as far as I know, this would only help add MacOS binaries.

I'm not sure if there is a service offering out there that is inexpensive that could be used to help automate the building of Java binaries for many target platforms, but if so, that would be interesting to me.

Also, I would happily buy @xeraph a Raspberry Pi to contribute to this effort :-)

xeraph commented 2 years ago

@doctore74 Just released Mac OS binary. Our team is setting up ARM server on cloud to build image. Try https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.3.1/logpresso-log4j2-scan-2.3.1-darwin.tar.gz

xeraph commented 2 years ago

@doctore74 Just released linux aarch64 binary. https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.3.1/logpresso-log4j2-scan-2.3.1-linux-aarch64.tar.gz

jgstew commented 2 years ago

Well that was fast. I was just googling emulating a raspberry pi with Qemu:

jgstew commented 2 years ago

@xeraph there is macos intel CPU and there is macos apple arm CPU. I assume the binary is for Intel CPUs? Might make sense to note that in the name of the file, though I guess same as Linux where the default one is Intel, then the one named differently is Arm.

xeraph commented 2 years ago

@jgstew Our team tested both MacOS 12.0.1 (arm) and MacOS 12.0.1 (x64). Single Mach-O image works for arm and x64.

doctore74 commented 2 years ago

This is awesome guys! What about using logpresso in a Monitoring Tool on a regular basis. Btw. we did this. Is someone interested?

xeraph commented 2 years ago

@doctore74 Great idea. Would you introduce what you did in https://github.com/logpresso/CVE-2021-44228-Scanner/issues/96 ?

doctore74 commented 2 years ago

@jgstew Our team tested both MacOS 12.0.1 (arm) and MacOS 12.0.1 (x64). Single Mach-O image works for arm and x64.

I successfully tested the Darwin binary on a M1 Mac.

doctore74 commented 2 years ago

@doctore74 Just released linux aarch64 binary. https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.3.1/logpresso-log4j2-scan-2.3.1-linux-aarch64.tar.gz

Nice, but that was not Raspberry, correct? Raspberry uses ARM. @jgstew Does the MacOS 12.0.1 (arm) work here?