-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
9 changed files
with
35 additions
and
34 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,5 +1,6 @@ | ||
# Maven | ||
target/ | ||
dependency-reduced-pom.xml | ||
|
||
# IntelliJ | ||
.idea/ | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,25 +1,25 @@ | ||
# Log4NoShell | ||
A Java Agent that disables Apache Log4J's JNDI Lookup to aid against [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) ("Log4Shell"). | ||
A Java Agent that disables Apache Log4J's JNDI Lookup to mitigate [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) ("Log4Shell"). | ||
|
||
If possible, update your program to use the latest Log4J version, as the vulnerability is fixed as of version *2.17.1*. | ||
Otherwise, download [log4noshell-0.4-SNAPSHOT-shaded.jar](https://winnpixie.github.io/log4noshell/log4noshell-0.4-SNAPSHOT-shaded.jar) and continue reading. | ||
Otherwise, download [log4noshell-0.5.jar](log4noshell-0.5.jar) and continue reading. | ||
|
||
## Usage | ||
To use Java Agents, you must specify them with the `-javaagent` argument. \ | ||
`java -jar -javaagent:path/to/log4noshell-0.4-SNAPSHOT-shaded.jar Program.jar` | ||
`java -javaagent:path/to/log4noshell-0.5.jar -jar Program.jar` | ||
|
||
### **Minecraft** | ||
Please read [Mojang's response](https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition) | ||
to the matter to determine if you need this patcher. | ||
to determine if you might need this patcher. | ||
|
||
- Client: | ||
1. Go to the *Installations* tab in the launcher | ||
2. Click on the **three dots** on the **right** side of the version you'd like to use | ||
3. Click *Edit* | ||
4. Scroll down and click on *More Options* | ||
5. Add `-javaagent:path/to/log4noshell-0.4-SNAPSHOT-shaded.jar` to the *JVM Arguments* text-field | ||
- `-javaagent:path/to/log4noshell-0.4-SNAPSHOT-shaded.jar -Xms2G -Xms2G...` | ||
5. Add `-javaagent:path/to/log4noshell-0.5.jar` to the *JVM Arguments* text-field | ||
- `-javaagent:path/to/log4noshell-0.5.jar -Xms2G -Xms2G...` | ||
6. Click *Save* | ||
- Server: | ||
1. Add `-javaagent:path/to/log4noshell-0.4-SNAPSHOT-shaded.jar` somewhere before the `-jar` in your launch/start/run command | ||
- `java -javaagent:path/to/log4noshell-0.4-SNAPSHOT-shaded.jar -jar minecraft_server.jar` | ||
1. Add `-javaagent:path/to/log4noshell-0.5.jar` somewhere before the `-jar` in your launch/start/run command | ||
- `java -javaagent:path/to/log4noshell-0.5.jar -jar minecraft_server.jar` |
Binary file not shown.
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
14 changes: 0 additions & 14 deletions
14
src/main/java/io/github/winnpixie/log4noshell/Log4NSAgent.java
This file was deleted.
Oops, something went wrong.
15 changes: 15 additions & 0 deletions
15
src/main/java/io/github/winnpixie/log4noshell/Log4NoShellAgent.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
package io.github.winnpixie.log4noshell; | ||
|
||
import java.lang.instrument.Instrumentation; | ||
import java.util.logging.LogManager; | ||
import java.util.logging.Logger; | ||
|
||
public class Log4NoShellAgent { | ||
public static final Logger LOGGER = LogManager.getLogManager().getLogger(Log4NoShellAgent.class.getName()); | ||
|
||
public static void premain(String args, Instrumentation inst) { | ||
LOGGER.info("Log4NoShell, a Java agent to mitigate CVE-2021-44228 (\"Log4Shell\")"); | ||
|
||
inst.addTransformer(new JndiLookupTransformer()); | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,2 +1,2 @@ | ||
Manifest-Version: 1.0 | ||
Premain-Class: io.github.winnpixie.log4noshell.Log4NSAgent | ||
Premain-Class: io.github.winnpixie.log4noshell.Log4NoShellAgent |