From 0e97910f09410342746457a30816749fc8027757 Mon Sep 17 00:00:00 2001 From: "mergebase.com" <41974443+juliusmusseau@users.noreply.github.com> Date: Wed, 22 Dec 2021 09:25:04 -0800 Subject: [PATCH] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index b2ca829..05197e7 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ Scanner that detects vulnerable Log4J versions to help teams assess their exposu # Introduction Currently reports [log4j-core](https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/) versions 2.3.1, 2.12.3, and 2.17.0 as **\_SAFE\_**, 2.12.2, 2.15.0 and 2.16.0 as **\_OKAY\_** and all other versions as **\_VULNERABLE\_** -(although it does report pre-2.0-beta9 as "**\_POTENTIALLY_SAFE\_**"). It reports older log4j-1.x [log4j/log4j](https://repo1.maven.org/maven2/log4j/log4j/) versions as **\_OLD\_**. +(although it does report pre-2.0-beta9 as **\_POTENTIALLY_SAFE\_**). It reports older log4j-1.x [log4j/log4j](https://repo1.maven.org/maven2/log4j/log4j/) versions as **\_OLD\_**. Can correctly detect log4j inside executable spring-boot jars/wars, dependencies blended into [uber jars](https://mergebase.com/blog/software-composition-analysis-sca-vs-java-uber-jars/), shaded jars, and even