log4jscanlinux
log4jscanlinux copied to clipboard
Qualys
We are still working to confirm, but it appears files with multiple extensions are being detected as vulnerable .jars by this script. One such example was a file called "log4j-core...
The Linux FHS specifically restricts subdirs under /usr/local. https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s09.html Please consider packaging this under /opt/qualys and reamin FHS compliant. Thanks.
The macOS grep command (BSD based) does not have a -P flag (perl regexp), so this part of the script (https://github.com/Qualys/log4jscanlinux/blob/344d45ed24ba056e6bc13b61dbc0475169b7507c/linux/log4j_findings.sh#L106) fails on macOS.
When unzip command is extracting the zip file, it's prompting to enter the option and waiting for the user intervention. It's not moving further. Error Log : Scanning started.. Fri...
`jar` binary required, but presence not checked on solaris. Some of my solaris systems nave no `jar` binary, then scanning silently not working.
Last version doesn't work in Centos. Launches without finishing
I executed the script on my host but not getting the desired output as mentioned in the sample. I was wondering if Qualys agent has to be installed on the...
When the script encounters a password-protected compressed file (ZIP), it hangs upon waiting for user input and outputs the password prompt to stderr. Expected behavior would be to skip the...
We would like an option for the scanner to read the std.out file and then only scan files listed in the signature file AND create a new std.out file. Another...
