Welcome to log4j-finder Discussions!

[yunzheng]

👋 Welcome!

We’re using Discussions as a place to connect with other members using log4j-finder. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about your experience with log4j-finder.

[gsoyars]

Hi,
I downloaded and used log4j-finder.exe 2 days ago. Since then I've seen lots of suggestions, issues and closed issues, but I don't see a new .exe release incorporating any of those issues. Are you going to be creating a new .exe release soon?

Also, can anyone say how confident I can be that log4j-finder finds all vulnerabilities, or should I be looking for another scanner to check for more vulnerabilities? So far in my network, I've only detected 3 software programs that were vulnerable: APC's PowerChute, Microsoft's Power Automate Desktop, and Symantec Endpoint Protection Manager.

[yunzheng]

Yes, we will make a new release soon. If you cannot wait you could grab automatic builds (non release) from GitHub actions page: https://github.com/fox-it/log4j-finder/actions

[PaulHoving]

Hi,
Can you sign the executable so that there is no trust warning on the executable?
We would like to point our end-users to the log4j-finder executable. And we do not want to have our users ignore warnings.

[yunzheng]

We will check what we can do

[yunzheng]

We have now signed the v1.2.0 windows executable, attached to the v1.20 release page:

https://github.com/fox-it/log4j-finder/releases/download/v1.2.0/log4j-finder-windows-signed-v1.2.0.zip
https://github.com/fox-it/log4j-finder/releases/download/v1.2.0/log4j-finder-signed.exe

Future releases will also be signed.

[PaulHoving]

Great! Thanks.

[PaulHoving]

Windows Defender (smartscreen) still warns about the download being 'not commonly downloaded' :-( I haven't dive into it yet how to resolve this. A developer is able to submit the file for whitelisting: (https://www.microsoft.com/en-us/wdsi/filesubmission)

[ovillage]

log4j for old linux version.
i get this error on centos version old than 7.
./log4j-finder
[151777] Error loading Python lib '/tmp/_MEIutgH2h/libpython3.7m.so.1.0': dlopen: /lib64/libc.so.6: version `GLIBC_2.14' not found (required by /tmp/_MEIutgH2h/libpython3.7m.so.1.0)
how can i fix it.
can you provide python 2 version of the script or binary to run on old linux version.

[Skmaddali]

Team, can some advise how can we use this script for the MacOS Client's ? possible running the script via JAMF PRO