search

terryyin / lizard

A simple code complexity analyser without caring about the C/C++ header files or Java imports, supports most of the popular languages.
Other
1.82k stars 248 forks source link

log4j vulnerability validation #339

Closed ghost closed 2 years ago

ghost commented 2 years ago

Hi team, as we all know log4j vulnerability came recently and I am using lizard soo need to know is lizard is using log4j internally or not.

terryyin commented 2 years ago

Not directly. The one chance that log4j is related to lizard is when people are running it on JPython.

But as a static analysis tool, I don’t think the threat is relevant, unless someone is running it as a service…

On 16 Dec 2021, at 2:15 PM, Samuel Katapur @.***> wrote:

Hi team, as we all know log4j vulnerability came recently and I am using lizard soo need to know is lizard is using log4j internally or not.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/terryyin/lizard/issues/339, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAGASYVZKH573R7K6O74MLTURF7ZHANCNFSM5KFOL7SQ. Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.