search

mergebase / log4j-detector

A public open sourced tool. Log4J scanner that detects vulnerable Log4J versions (CVE-2021-44228, CVE-2021-45046, etc) on your file-system within any application. It is able to even find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too! TAG_OS_TOOL, OWNER_KELLY, DC_PUBLIC
Other
638 stars 98 forks source link

Would it make sense to excluce "/System/Volumes/Data/"? #51

Closed donmontalvo closed 2 years ago

donmontalvo commented 2 years ago

$ tail -f /Library/Application\ Support/Vanguard/SearchResults/log4j-detector/log4j-detector.txt -- github.com/mergebase/log4j-detector v2021.12.17 (by mergebase.com) analyzing paths (could take a while). -- Note: specify the '--verbose' flag to have every file examined printed to STDERR. /Applications/AWS Schema Conversion Tool.app/Contents/Java/packager_jar/AWSSchemaConversionTool.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /Applications/AWS Schema Conversion Tool.app/Contents/Java/packager_jar/AWSSchemaConversionToolBatch.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /Applications/Tableau Desktop 2021.2.app/Contents/Resources/jdbcserver.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /Applications/Tableau Desktop 2021.2.app/Contents/Resources/oauthservice.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /Applications/Tableau Prep Builder 2021.2.app/Contents/lib/tableau-prep-cli.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /Applications/Tableau Prep Builder 2021.2.app/Contents/Resources/app/loom-rest-api-1.0-SNAPSHOT.jar!/BOOT-INF/lib/log4j-core-2.13.2.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /Applications/Tableau Prep Builder 2021.2.app/Contents/Resources/app/tableau-1.3/build/Release/jdbcserver.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /Applications/Tableau Prep Builder 2021.2.app/Contents/Resources/app/tableau-1.3/build/Release/oauthservice.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /Applications/Xcode.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/itms/share/OSGi-Bundles/org.apache.logging.log4j.core-2.11.2.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /Library/Application Support/JAMF/Composer/Sources/Xcode/ROOT/Applications/Xcode.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/itms/share/OSGi-Bundles/org.apache.logging.log4j.core-2.11.2.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /System/Volumes/Data/Applications/AWS Schema Conversion Tool.app/Contents/Java/packager_jar/AWSSchemaConversionTool.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /System/Volumes/Data/Applications/AWS Schema Conversion Tool.app/Contents/Java/packager_jar/AWSSchemaConversionToolBatch.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /System/Volumes/Data/Applications/Tableau Desktop 2021.2.app/Contents/Resources/jdbcserver.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /System/Volumes/Data/Applications/Tableau Desktop 2021.2.app/Contents/Resources/oauthservice.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /System/Volumes/Data/Applications/Tableau Prep Builder 2021.2.app/Contents/lib/tableau-prep-cli.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /System/Volumes/Data/Applications/Tableau Prep Builder 2021.2.app/Contents/Resources/app/loom-rest-api-1.0-SNAPSHOT.jar!/BOOT-INF/lib/log4j-core-2.13.2.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /System/Volumes/Data/Applications/Tableau Prep Builder 2021.2.app/Contents/Resources/app/tableau-1.3/build/Release/jdbcserver.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /System/Volumes/Data/Applications/Tableau Prep Builder 2021.2.app/Contents/Resources/app/tableau-1.3/build/Release/oauthservice.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /System/Volumes/Data/Applications/Xcode.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/itms/share/OSGi-Bundles/org.apache.logging.log4j.core-2.11.2.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_ /System/Volumes/Data/Library/Application Support/JAMF/Composer/Sources/Xcode/ROOT/Applications/Xcode.app/Contents/SharedFrameworks/ContentDeliveryServices.framework/Versions/A/itms/share/OSGi-Bundles/org.apache.logging.log4j.core-2.11.2.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE_