search

mergebase / log4j-detector

A public open sourced tool. Log4J scanner that detects vulnerable Log4J versions (CVE-2021-44228, CVE-2021-45046, etc) on your file-system within any application. It is able to even find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too! TAG_OS_TOOL, OWNER_KELLY, DC_PUBLIC
Other
638 stars 98 forks source link

Problem output when scanning in Windows #23

Open trfreecodecamp opened 2 years ago

trfreecodecamp commented 2 years ago

I get a lot of these types of "Problem" messages. Are they safe to ignore? I am running in Windows.

-- Problem: C:\Program Files\Commvault\ContentStore\CVMedia\11.0.0\Windows\BinaryPayload\LooseUpdates\CU38\BinaryPayload\adLdapTool.exe.zip - Not actually a zip!?! (no magic number) -- Problem C:\tools\QA_Automation_backup.zip!/selenium-java-client-driver.jar - java.io.EOFException: Unexpected end of ZLIB input stream

juliusmusseau commented 2 years ago

The "no magic number" warnings are definitely safe to ignore (means the file is not a zip despite its name, and thus cannot end up in Java's classpath).

Are you able to attach the "selenium-java-client-driver.jar" file? I'd like to investigate that one and see if there's possibly a bug in my code.

trfreecodecamp commented 2 years ago

This zip file contains the selenium-java-client-driver.jar file. I think the problem may be due to whatever compression sw was used to create it. I extracted the folder and ran the detector with no problems.
I then used 7-zip to compress it again. Again no problem with the new zip file.
I ran the detector against the jar file directly. Again no problem. The problem only occurs with the original zip file. I pared it down to just 2 jar files. selenesse-mck_reduced.zip