Skip to content

Commit

Permalink
Update README
Browse files Browse the repository at this point in the history
  • Loading branch information
saharNooby committed Dec 11, 2021
1 parent 89d52e2 commit 77fb42b
Show file tree
Hide file tree
Showing 2 changed files with 31 additions and 2 deletions.
31 changes: 30 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,32 @@
# log4j-vulnerability-patcher-agent

Fixes CVE-2021-44228 in log4j by patching JndiLookup class.
This agent fixes critical vulnerability [CVE-2021-44228](https://www.lunasec.io/docs/blog/log4j-zero-day/) in log4j by patching `JndiLookup` class, as recommended [here](https://www.lunasec.io/docs/blog/log4j-zero-day/#temporary-mitigation).

**WARNING: this is not a substitute for proper upgrade to log4j 2.15.0**, where this vulnerability was fixed for good. Use this agent **IF, and ONLY IF, you can't upgrade log4j in your app**.

Agent can run on JRE 8 and higher, in any application (including Minecraft clients and servers).

This will completely disable `JNDI` in log4j. If you need this functionality, do not use this agent.

## How to use

1. Download agent JAR or build it yourself
2. Add command line argument `-javaagent:/path/to/agent/log4j-vulnerability-patcher-agent.jar` to the start command of your app

Example command line:

```shell
java -javaagent:/home/user/log4j-vulnerability-patcher-agent.jar -Xmx1G spigot.jar
```

If everything is OK, on start agent will output `[Log4jVulnerabilityPatcherAgent] JndiLookup was patched, vulnerability fixed!`.

## Build

You will need JDK 8, Maven and Git.

```shell
git clone https://github.com/saharNooby/log4j-vulnerability-patcher-agent.git
cd log4j-vulnerability-patcher-agent
mvn clean package
```
2 changes: 1 addition & 1 deletion pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
</goals>

<configuration>
<shadedArtifactAttached>true</shadedArtifactAttached>
<finalName>log4j-vulnerability-patcher-agent</finalName>

<transformers>
<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
Expand Down

0 comments on commit 77fb42b

Please sign in to comment.