How to Find Dangerous Log4j Libraries

3 years ago thenewstack.io

Summary: This is a summary of an article originally published by The New Stack. Read the full original article here →

The Apache https://thenewstack.io/log4shell-we-are-in-so-much-trouble/ logging library has become the COVID-19 of technology. As of Dec. 21, the latest patched Log4j is version https://www.zdnet.com/article/apache-releases-new-2-17-0-patch-for-log4j-to-solve-denial-of-service-vulnerability/ If you have that installed in the right places, you’re good.

The trick, of course, is finding that pesky Apache logging library.

A JAR file can contain JAR files, and those also contain JAR files.

There are also programs, almost all of which are open source, that can be used just to find log4j libraries.

DevOps Articles