New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

zaproxy contains log4j exploit code #599

Open

BustedSec opened this issue Sep 20, 2022 · 1 comment

Contributor

BustedSec commented Sep 20, 2022

The version of ZAP installed is behind the master branch that addressed this

References:
https://www.blumira.com/analysis-log4shell-local-trigger/
https://www.lunasec.io/docs/blog/log4j-zero-day-update-on-cve-2021-45046/

zaproxy/zaproxy#6979.
zaproxy/zaproxy#6980

Unsure what magic was done,

but the magic needs updating to the most recent URL to pull a newer version via wget.

Contributor

0xv1n commented Sep 28, 2024

Old issue, but no longer needs to be addressed as the latest Zaproxy release uses log4j 2.20.0 per bom.json .

ref: https://github.com/zaproxy/zaproxy/releases/tag/v2.15.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment