Unzip exceptions with 14-12, but 13-12 works

[mergebase]

Unzip exceptions with 14-12, but 13-12 works

[jsark78]

Additional note: This problem is also not specific to WAR files. I encountered the same problem on various hosts also when using the tool on JAR files, or paths with JAR files in them.

[jsark78]

Also, the tool says "No vulnerable Log4J 2.x samples found in supplied paths: ..." even if there were errors.

Please kindly reconsider this. A tool should NOT say that everything is okay when there were errors (e.g. in my case, it didn't check ANY of the files successfully, but still summarizes that there are no vulnerabilities)! That seems dangerous to me.

[jsark78]

Here's the full exception, including call stack.

-- Problem: /opt/tomcat/webapps/awi/WEB-INF/bundle/webui-logback.jar!/lib/logback-core-1.2.3.jar - java.io.EOFException: Unexpected end of ZLIB input stream
java.io.EOFException: Unexpected end of ZLIB input stream
at java.util.zip.InflaterInputStream.fill(Unknown Source)
at java.util.zip.InflaterInputStream.read(Unknown Source)
at java.util.zip.ZipInputStream.read(Unknown Source)
at java.util.zip.ZipInputStream.closeEntry(Unknown Source)
at java.util.zip.ZipInputStream.getNextEntry(Unknown Source)
at com.mergebase.log4j.Log4JDetector.findLog4jRecursive(Log4JDetector.java:205)
at com.mergebase.log4j.Log4JDetector.findLog4jRecursive(Log4JDetector.java:282)
at com.mergebase.log4j.Log4JDetector.scan(Log4JDetector.java:439)
at com.mergebase.log4j.Log4JDetector.analyze(Log4JDetector.java:499)
at com.mergebase.log4j.Log4JDetector.analyze(Log4JDetector.java:494)
at com.mergebase.log4j.Log4JDetector.analyze(Log4JDetector.java:494)
at com.mergebase.log4j.Log4JDetector.analyze(Log4JDetector.java:494)
at com.mergebase.log4j.Log4JDetector.analyze(Log4JDetector.java:494)
at com.mergebase.log4j.Log4JDetector.main(Log4JDetector.java:81)

[juliusmusseau]

Fixed in v2021.12.16.

Re: ". A tool should NOT say that everything is okay when there were errors" - I will create a new ticket to track this idea.

[juliusmusseau]

p.s. I now leave the pre-built binaries (including older versions) in the root folder (built with Java 6 because I'm that nice).

p.p.s. There is a super-secret "--debug" flag that causes the tool to list every *.class file it examines.

[jsark78]

Thanks, this is all very good news. Also many thanks for your work!