Do not remove JndiLookup.class for log4j 2.17.0 (CVE-2021-44832)

Author: xeraph

README.md

@@ -3,16 +3,16 @@
 log4j2-scan is a single binary command-line tool for CVE-2021-44228 vulnerability scanning and mitigation patch. It also supports nested JAR file scanning and patch. It also detects CVE-2021-45046 (log4j 2.15.0), CVE-2021-45105 (log4j 2.16.0), CVE-2021-44832 (log4j 2.17.0), CVE-2021-4104 (log4j 1.x), and CVE-2021-42550 (logback 0.9-1.2.7) vulnerabilities.
 
 ### Download
-* [log4j2-scan 2.6.4 (Windows x64, 7z)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.6.4/logpresso-log4j2-scan-2.6.4-win64.7z)
-* [log4j2-scan 2.6.4 (Windows x64, zip)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.6.4/logpresso-log4j2-scan-2.6.4-win64.zip)
+* [log4j2-scan 2.6.5 (Windows x64, 7z)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.6.5/logpresso-log4j2-scan-2.6.5-win64.7z)
+* [log4j2-scan 2.6.5 (Windows x64, zip)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.6.5/logpresso-log4j2-scan-2.6.5-win64.zip)
   * If you get `VCRUNTIME140.dll not found` error, install [Visual C++ Redistributable](https://docs.microsoft.com/en-US/cpp/windows/latest-supported-vc-redist?view=msvc-170).
   * If native executable doesn't work, use the JAR instead. 32bit is not supported.  
   * 7zip is available from www.7zip.org, and is open source and free.
-* [log4j2-scan 2.6.4 (Linux x64)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.6.4/logpresso-log4j2-scan-2.6.4-linux.tar.gz)
-* [log4j2-scan 2.6.4 (Linux aarch64)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.6.4/logpresso-log4j2-scan-2.6.4-linux-aarch64.tar.gz)
+* [log4j2-scan 2.6.5 (Linux x64)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.6.5/logpresso-log4j2-scan-2.6.5-linux.tar.gz)
+* [log4j2-scan 2.6.5 (Linux aarch64)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.6.5/logpresso-log4j2-scan-2.6.5-linux-aarch64.tar.gz)
   * If native executable doesn't work, use the JAR instead. 32bit is not supported.
-* [log4j2-scan 2.6.4 (Mac OS)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.6.4/logpresso-log4j2-scan-2.6.4-darwin.zip)
-* [log4j2-scan 2.6.4 (Any OS, 620KB)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.6.4/logpresso-log4j2-scan-2.6.4.jar)
+* [log4j2-scan 2.6.5 (Mac OS)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.6.5/logpresso-log4j2-scan-2.6.5-darwin.zip)
+* [log4j2-scan 2.6.5 (Any OS, 620KB)](https://github.com/logpresso/CVE-2021-44228-Scanner/releases/download/v2.6.5/logpresso-log4j2-scan-2.6.5.jar)
 
 ### Build
 * [How to build Native Image](https://github.com/logpresso/CVE-2021-44228-Scanner/wiki/FAQ#how-to-build-native-image)
@@ -22,7 +22,7 @@ Just run log4j2-scan.exe or log4j2-scan with target directory path. The logpress
 
 Usage
 ```
-Logpresso CVE-2021-44228 Vulnerability Scanner 2.6.4 (2021-12-29)
+Logpresso CVE-2021-44228 Vulnerability Scanner 2.6.5 (2021-12-29)
 Usage: log4j2-scan [--scan-log4j1] [--fix] target_path1 target_path2
 
 -f [config_file_path]
@@ -104,7 +104,7 @@ On Linux
 ```
 On UNIX (AIX, Solaris, and so on)
 ```
-java -jar logpresso-log4j2-scan-2.6.4.jar [--fix] target_path
+java -jar logpresso-log4j2-scan-2.6.5.jar [--fix] target_path
 ```
 
 If you add `--fix` option, this program will copy vulnerable original JAR file to .bak file, and create new JAR file without `org/apache/logging/log4j/core/lookup/JndiLookup.class` entry. All .bak files are archived into the single zip file which is named by `log4j2_scan_backup_yyyyMMdd_HHmmss.zip`, then deleted safely. In most environments, JNDI lookup feature will not be used. However, you must use this option at your own risk. You can easily restore original vulnerable JAR files using `--restore` option.

pom.xml

@@ -6,7 +6,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>com.logpresso</groupId>
 	<artifactId>log4j2-scanner</artifactId>
-	<version>2.6.4</version>
+	<version>2.6.5</version>
 	<packaging>jar</packaging>
 	<name>Logpresso Log4j2 Scanner</name>
 

src/main/java/com/logpresso/scanner/Log4j2Scanner.java

@@ -11,6 +11,7 @@
 import java.text.SimpleDateFormat;
 import java.util.ArrayList;
 import java.util.Date;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 import java.util.zip.ZipEntry;
@@ -23,7 +24,7 @@
 import com.logpresso.scanner.utils.ZipUtils;
 
 public class Log4j2Scanner {
-	public static final String VERSION = "2.6.4";
+	public static final String VERSION = "2.6.5";
 	public static final String RELEASE_DATE = "2021-12-29";
 	public static final String BANNER = "Logpresso CVE-2021-44228 Vulnerability Scanner " + VERSION + " (" + RELEASE_DATE + ")";
 
@@ -309,21 +310,25 @@ private void fix() {
 				continue;
 			}
 
-			// do not patch if jar has only CVE-2021-45105 vulnerability
-			String except = "";
+			// do not patch if jar has only CVE-2021-45105 or CVE-2021-44832 vulnerability
+			Set<String> exceptCves = new HashSet<String>();
 			boolean needFix = false;
 
 			// report entries are added by original file. beware of symbolic link case
 			List<ReportEntry> entries = detector.getReportEntries(vf.getFile());
 			for (ReportEntry entry : entries) {
-				if (entry.getCve().equals("CVE-2021-45105"))
-					except = " (except CVE-2021-45105)";
+				String cve = entry.getCve();
+				if (cve.equals("CVE-2021-45105") || cve.equals("CVE-2021-44832"))
+					exceptCves.add(cve);
 				else
 					needFix = true;
 			}
 
+			String except = " (except " + StringUtils.join(exceptCves, ", ") + ")";
+
 			if (!needFix) {
-				System.out.printf("Cannot fix CVE-2021-45105, Upgrade it: %s%s%n", f.getAbsolutePath(), symlinkMsg);
+				System.out.printf("Cannot fix " + StringUtils.join(exceptCves, ", ") + ", Upgrade it: %s%s%n",
+						f.getAbsolutePath(), symlinkMsg);
 				continue;
 			}
 

src/main/java/com/logpresso/scanner/utils/StringUtils.java

@@ -1,5 +1,6 @@
 package com.logpresso.scanner.utils;
 
+import java.util.Collection;
 import java.util.List;
 
 public class StringUtils {
@@ -13,7 +14,7 @@ public static String toString(List<String> pathChain) {
 		return join(pathChain, " > ");
 	}
 
-	public static String join(List<String> tokens, String separator) {
+	public static String join(Collection<String> tokens, String separator) {
 		StringBuilder sb = new StringBuilder();
 		int i = 0;