search

sassoftware / loguccino

Scan and patch tool for CVE-2021-44228 and related log4j concerns.
Apache License 2.0
34 stars 5 forks source link

The patching mechanism should be explained better #8

Open glswager opened 2 years ago

glswager commented 2 years ago

Please explain better how the patching mechanism works.

For example...does it:

  1. copy the vulnerable archive/file
  2. Expand it in the patching directory
  3. Patch it
  4. re-archive the patched version
  5. copy the patched version into place of the vulnerable archive/file in the deployment
  6. In the patched directory, the copy of the original (vulnerable) file/archive remains

We want to be clear about what is being left behind here and in what state so folks can determine whether/when it's safe to delete any content that contains the vulnerability.

Thanks!