search

logpresso / CVE-2021-44228-Scanner

Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228
Apache License 2.0
851 stars 174 forks source link

networking in v3 #277

Closed k3it closed 2 years ago

k3it commented 2 years ago

i’m not sure what to think about the new option for connecting and sending results to an external site. it may raise some eyebrows. even though we know this is benign, not all organizations are as trusting. since the scanner runs as root it should not be making any network calls in my opinion.

maybe a better solution would be to organize uploads of the output using separate tool or via a website.

xeraph commented 2 years ago

@k3it 2.x version also provides syslog networking and some users using it for centralized reporting. I'll provide minified version without --enable-https in the next releases.

k3it commented 2 years ago

i appreciate the reply. thank you for publishing a flexible multi platform scanning tool!

xeraph commented 2 years ago

@k3it v3.0.1 released. You can use -no-https version.