如果 jar 在 windows/linux/mac 中使用易受攻击的 log4j 版本，如何查找和修复
[英]How to find and fix if a jar is using vulnerable version of log4j in windows/linux/mac
问题描述
log4j security vulnerbility find and fix? 
log4j 安全漏洞找到并修复？ Any tool to help find the current usage of log4j version and fix for springboot app.任何有助于查找 log4j 版本的当前使用情况并修复 springboot 应用程序的工具。
1 个解决方案
解决方案1
0 2021-12-16 09:46:41
Found this great tool that helped in scanning log4j dependencies used in a jar: https://github.com/logpresso/CVE-2021-44228-Scanner Install it on the required platform and run the binary with the path to scan. Found this great tool that helped in scanning log4j dependencies used in a jar: https://github.com/logpresso/CVE-2021-44228-Scanner Install it on the required platform and run the binary with the path to scan. eg: ./log4j2-scan /var/lib/jenkins/ It'll scan and show you the report.例如： ./log4j2-scan /var/lib/jenkins/它会扫描并向您显示报告。
For the Spring-boot-starter-log4j2 to use the latest version of log4j, follow the below GitHub link and make the required change in the build file to enable spring-boot to make use of the latest required package. For the Spring-boot-starter-log4j2 to use the latest version of log4j, follow the below GitHub link and make the required change in the build file to enable spring-boot to make use of the latest required package.
https://github.com/spring-projects/spring-boot/issues/28958 https://github.com/spring-projects/spring-boot/issues/28958
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.