Apache Log4j 1.2.x 버전 취약점 해결 방법

Apache Log4j 1.2.x 버전 취약점 해결 방법

 

 

---

While not affected by the exact same log4shell issue, the apache log4j team recommends to remove JMSAppender and SocketServer, which has a vulnerability in CVE-2019-17571, from your jar files.

You can use the zip command to remove the affected classes, replace the filename/version with yours:

zip -d log4j-1.2.16.jar org/apache/log4j/net/JMSAppender.class
zip -d log4j-1.2.16.jar org/apache/log4j/net/SocketServer.class

You can look through through the files in your zip using less and grep,
e.g. less log4j-1.2.16.jar | grep JMSAppender

That being said, Apache recommends that you upgrade to the 2.x version if possible. According to their security page:

Please note that Log4j 1.x has reached end of life and is no longer supported. Vulnerabilities reported after August 2015 against Log4j 1.x were not checked and will not be fixed. Users should upgrade to Log4j 2 to obtain security fixes.

Share

Improve this answer

Follow

edited 9 hours ago

 

 

answered yesterday

giraffesyo

3,79311 gold badge2222 silver badges35

 

---

https://stackoverflow.com/questions/70310980/log4j-vulnerability-is-log4j1-2-17-vulnerable-was-unable-to-find-any-jndi-cod

log4j-vulnerability - Is log4j1.2.17 vulnerable (was unable to find any jndi code in source)?

 

#log4j-vulnerability