log4fix

log4fix This tool is to detect and fix the log4j log4shell vulnerability CVE-2021-44228 by looking and removing the JndiLookup class from .jar/.war/.ear files with zero dependencies for free. This tool has been tested on: - Linux 32bit and 64 bit - Windows 32 bit and 64 bit - OpenBSD 64 bit This...

log4j-CVE-2021-44228-workaround

log4j-CVE-2021-44228-workaround A. Solution Description This project provides a general purpose workaround for the log4j CVE-2021-44228 vulnerability, which can be used in case you do not have the alternative in short term to re-build your respective project or to patch the log4j-core jars. The...

CVE-2021-44228-Scanner

log4j2-scan is a single binary command-line tool for CVE-2021-44228 vulnerability scanning and mitigation patch. It also supports nested JAR file scanning and patch. Download log4j2-scan 1.3.1 Windows x64 If native executable doesn't work, use the JAR instead. 32bit is not supported. log4j2-scan...

log4j-patched

Log4J Patched Dependency for Log4Shell This repository aims to provide a patched version of the Log4J library for legacy system that can not be updated right away. The patch consist in a modified version of the log4j-core.x.x.x.jar file following the official recommandation of the Apache...

log4j-log4shell-playground

About A playground for poking at the critical log4j aka Log4Shell CVE-2021-44228 vulnerability mitigations. This particular problem lies within the JndiLookup feature and the log4j ability to interpret ALL the arguments of a logging call. I would expect it to only interpret the format message the...

cve-2021-44228-qingteng-patch

Qingteng log4j2-patch https://github.com/qingtengyun/cve-2021-44228-qingteng-patch Fixes CVE-2021-44228 for log4j2, using the Instrumentation API provided by the JVM to modify existing bytecode loaded into the JVM. Without restarting the Java process, it modifies the lookup method of...

JndiLookup

JndiLookup Some tool to help analyzing Apache Log4j 2 CVE-2021-44228 This tool uses the "lookup" feature from log4j-2 to test against the JNDI vulnerability. The objective is to easily run the lookup feature to normalize logs for example or to do a real testing on some payload - please be cautiou...

CVE-2021-44228_scanner

CVE-2021-44228scanner Applications that are vulnerable to the log4j CVE-2021-44228 issue may be detectable by scanning jar, war, and ear files to search for the presence of JndiLookup.class. Depending on the platform that you are investigating, the PowerShell or the Python3 script may make more...

Log4jPatch

-- This repository has been archived -- Further development of this tool will continue at corretto/hotpatch-for-apache-log4j2. Thanks for sharing, commenting, trying it out and contributing to this project! Log4jPatch This is a POC of a simple tool which injects a Java agent into a running JVM...

CVE-2021-44228

Log4Shell CVE-2021-44228 Mitigation Ansible Role This Ansible role deploys a Python-based script to programmatically mitigate the Log4Shell vulnerability CVE-2021-44228 by removing the vulnerable JndiLookup class from affected Log4j JAR files. It is designed to be run via Ansible, but you can als...

log4shell

Log4Shell CVE-2021-44228 — Research Report A self-contained technical report on Log4Shell , the critical Remote Code Execution vulnerability in Apache Log4j 2 disclosed in December 2021. Covers root cause analysis, the full attack chain, detection/mitigation guidance, and an end-to-end exploit...

log4j-remediation

sakurajilog4j This tool is used to discover and remedidate the Log4Shell vulnerability CVE-2021-45105 by removing the 'JndiLookup.class' file from '.ear|.jar|.war' files on Windows, Linux & Mac OS. Usage: Scan OS for Log4Shell vulnerability. - sakurajilog4j discover - Example:...

log4j-vulnerability-patcher-agent

log4j-vulnerability-patcher-agent This agent fixes critical vulnerability CVE-2021-44228 in log4j by patching JndiLookup class, as recommended here. WARNING: this is not a substitute for proper upgrade to log4j 2.15.0 , where this vulnerability was fixed for good. Use this agent IF, and ONLY IF,...

l4j-fp1

log4shell false positive This is a simple web project with a sanitised log4shell vulnerability. For an unsanitised version, see https://github.com/scabench/l4j-tp1/. The project defines a simple scabench.HelloWorldService get service returning a plain text string hello world. The service does not...

log4jjndilookupremove

log4jjndilookupremove A simple script to remove Log4J JndiLookup.class from jars in given directory. This script can be used to temporarily resolve the CVE-2021-45046 and CVE-2021-44228, until the application can be repackaged with a proper Log4J version. Usage On Linux or other nix system just r...

Fix-CVE-2021-44228

CVE-2021-44228! The current program remove the class "org/apache/logging/log4j/core/lookup/JndiLookup.class" from your zip, jar, war, ear archive. Before use Follow the guide https://www.lunasec.io/docs/blog/log4j-zero-day-mitigation-guide/ before using. The utility will help your to apply "Modif...

divd-2021-00038--log4j-scanner

divd-2021-00038--log4j-scanner Este escáner recorrerá recursivamente rutas, incluyendo archivos comprimidos, en busca de versiones vulnerables de log4j y archivos org/apache/logging/log4j/core/lookup/JndiLookup.class. Actualmente la lista de permitidos define versiones no explotables, en este cas...

hotpatch-for-apache-log4j2

Log4jHotPatch Esta es una herramienta que inyecta un agente Java en un proceso JVM en ejecución. El agente intentará parchear el método lookup de todas las instancias cargadas de org.apache.logging.log4j.core.lookup.JndiLookup para que devuelvan incondicionalmente la cadena "Patched...

EUVD-2021-33999

Malicious code in bioql PyPI...

CVE-2021-4125

It was found that the original fix for log4j CVE-2021-44228 and CVE-2021-45046 in the OpenShift metering hive containers was incomplete, as not all JndiLookup.class files were removed. This CVE only applies to the OpenShift Metering hive container images, shipped in OpenShift 4.8, 4.7 and 4.6...