aschen/log4j-patchedProvide patched version of Log4J against CVE-2021-44228 and CVE-2021-45046 as well as a script to manually patch it yourself
This repository aims to provide a patched version of the Log4J library for legacy system that can not be updated right away.
The patch consist in a modified version of the log4j-core.x.x.x.jar file following the official recommandation of the Apache foundation.
The modified version does not contains the JndiLookup.class class anymore.
First, you shouldn't trust random people on internet.
This repository includes a script that allows to generated patched version of the library on your computer:
JndiLookup.class filelog4j-core-x.x.x.jar on your system by the patched one (use find / -name log4j-core*.jar to find it)version=2.8.2 # replace your desired version of log4j here
wget https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/$version/log4j-core-$version.jar
zip -q -d log4j-core-$version.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
If you cannot apply the patch yourself, you can directly download the patched jar from this repository:
Info: version before 2.0-beta9 are not affected since they do not contains the flawed class.