-
Notifications
You must be signed in to change notification settings - Fork 97
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Missing 'known bad' hash for versions <2.1? #70
Comments
Hi thanks for reporting! it looks like JndiManager.class is not in these versions so it does not show up. We will need to improve our version detection based on other things as well, such as parsing package metadata and hash other classes, etc. I already started some refactoring based on #51 |
Thanks for reply. Based on the info I've read online, the source of the vulnerability is jndiFilter.class, which does exist in 2.0.2. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Unless I have misunderstood, this vulnerability affects all versions of log4j from 2.0-beta9 to 2.14.1. I have scanned a directory that contains 2.0.2 and it didn't show up, presumably as there isn't a hash for it. I can supply a hash or a PR if needed.
The text was updated successfully, but these errors were encountered: