{"id":28909241,"url":"https://github.com/stripe/log4j-remediation-tools","last_synced_at":"2025-07-08T18:34:14.830Z","repository":{"id":66084046,"uuid":"438409343","full_name":"stripe/log4j-remediation-tools","owner":"stripe","description":"Tools for remediating the recent log4j2 RCE vulnerability (CVE-2021-44228)","archived":false,"fork":false,"pushed_at":"2023-03-21T09:51:33.000Z","size":37,"stargazers_count":41,"open_issues_count":2,"forks_count":8,"subscribers_count":8,"default_branch":"main","last_synced_at":"2025-06-21T17:08:31.242Z","etag":null,"topics":["log4j2","remediation","tools"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stripe.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2021-12-14T21:47:04.000Z","updated_at":"2024-08-18T16:13:22.000Z","dependencies_parsed_at":"2023-04-05T17:23:51.937Z","dependency_job_id":null,"html_url":"https://github.com/stripe/log4j-remediation-tools","commit_stats":{"total_commits":1,"total_committers":1,"mean_commits":1.0,"dds":0.0,"last_synced_commit":"167e1f9012a4e0b8b7e97f49e5ed6ef932a42c52"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/stripe/log4j-remediation-tools","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stripe%2Flog4j-remediation-tools","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stripe%2Flog4j-remediation-tools/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stripe%2Flog4j-remediation-tools/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stripe%2Flog4j-remediation-tools/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stripe","download_url":"https://codeload.github.com/stripe/log4j-remediation-tools/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stripe%2Flog4j-remediation-tools/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264324355,"owners_count":23590853,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["log4j2","remediation","tools"],"created_at":"2025-06-21T17:08:18.025Z","updated_at":"2025-07-08T18:34:14.823Z","avatar_url":"https://github.com/stripe.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# `log4j-remediation-tools`\n\n\u003e Tools for finding and reproducing the [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) `log4j2` vulnerability\n\n## Tools\n\n- [`find-vulnerabilities`](./find-vulnerabilities): determine heuristically whether a running JVM is vulnerable\n- [`confirm-vulnerabilities`](./confirm-vulnerabilities): determine with 100% accuracy whether a running JVM is vulnerable\n\n## Usage\n\nBoth of these tools scan all running JVM processes on a machine, and produce a CSV report about which processes may be / are vulnerable.\n\nCheck out the corresponding READMEs for [`find-vulnerabilities/`](./find-vulnerabilities) and [`confirm-vulnerabilities/`](./confirm-vulnerabilities) for usage details.\n\n### Which tool should I use?\n\nHere are a few tradeoffs to help you determine which tool is right for your use case:\n\n`find-vulnerabilities` is low-risk to run, but has the possibility of missing:\n\n- Cases where a system property is not set on the CLI, e.g. at runtime\n- Cases where the JVM has closed the file descriptor for the jar\n- Non-standard / patched releases of `log4j2`\n\n`confirm-vulnerabilities` uses the JVM Attach API which:\n\n- May not work if an application explicitly disables this API\n- May crash the running JVM due to JVM bugs\n- May briefly slow down the running JVM while waiting for JVM pause\n\n## Contributing\n\nThis project welcomes feedback and contributions; however, we might be slow to respond to or triage your requests. We appreciate your patience.\n\n## License\n\nThis project uses the [MIT license](LICENSE.md).\n\n## Code of conduct\n\nThis project has adopted the Stripe [Code of conduct](CODE_OF_CONDUCT.md).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstripe%2Flog4j-remediation-tools","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstripe%2Flog4j-remediation-tools","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstripe%2Flog4j-remediation-tools/lists"}