C:\Users\x\Downloads>dir .\l4j-test\
 Volume in drive C is Windows
 Volume Serial Number is x-x

 Directory of C:\Users\x\Downloads\l4j-test

14.12.2021  17:42    <DIR>          .
14.12.2021  17:42    <DIR>          ..
12.12.2021  23:35         1,789,565 log4j-core-2.16.0.jar
               1 File(s)      1,789,565 bytes
               2 Dir(s)  403,926,196,224 bytes free

C:\Users\x\Downloads>divd-2021-00038--log4j-scanner-windows-amd64.exe .\l4j-test\
divd-2021-00038--log4j-scanner by DTACT
http://github.com/dtact/divd-2021-00038--log4j-scanner

[ ] Using targets: .\l4j-test\
[!][l4j-test\log4j-core-2.16.0.jar -> org/apache/logging/log4j/core/lookup/JndiLookup.class] found JndiLookup.class with hash 085e0b34e40533015ba6a73e85933472702654e471c32f276e76cffcf7b13869 (version: )
[🏎]: Scan finished! 1 files scanned, 1 vulnerable files found, 0 vulnerable libraries found, 0 errors occured,  in 00h0
0m00s, average rate is: 649 files/min.

C:\Users\x\Downloads>

Running on Darwin. The scanner crashed while scanning a large fileset. [!][/xxxxxx/xxxxxx/xxxxxx/Library/Caches/Homebrew/downloads/2ac97b815131569d7888e06425f3446be8b2e68f8361ce20c65051f66cb23360--qt--6.2.2.monterey.bottle.tar.gz -> qt/6.2.2/share/qt/mkspecs/features/link_pkgconfig.prf] could not open zip file 1fe46b14df7175167596e630a8b1160a3e3e82d7bf62299b3acebd689a83675b panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0x112eee8]

I tried to run the scan for all local docker images. My docker daemon is Docker version 18.06.1-ce. I get the below error. Will there be too much of a difference between 1.40 and 1.38 to not support ?

root@services-test:~# docker --version
Docker version 18.06.1-ce, build e68fc7a

root@services-test:~# ./divd-2021-00038--log4j-scanner scan-image --local
divd-2021-00038--log4j-scanner by DTACT
http://github.com/dtact/divd-2021-00038--log4j-scanner
--------------------------------------
[ ] Currently scanning , checked 0 images in 00h:00m:00s. 
[!] Error identifying application: Error response from daemon: client version 1.40 is too new. Maximum supported API version is 1.38

root@services-test:~# cat /etc/os-release
NAME="RancherOS"
VERSION=v1.5.0
ID=rancheros
ID_LIKE=
VERSION_ID=v1.5.0
PRETTY_NAME="RancherOS v1.5.0"
HOME_URL="http://rancher.com/rancher-os/"
SUPPORT_URL="https://forums.rancher.com/c/rancher-os"
BUG_REPORT_URL="https://github.com/rancher/os/issues"
BUILD_ID=

Could it be that a module dependency for path io/fs is missing?

Trying to run the code I get the following error:

$ go run .
build github.com/dutchcoders/divd-2021-00038--log4j-scanner: cannot find module for path io/fs

I have absolutely 0 experience with Golang, so forgive me if this is just an user error.

The disable-color command-line flag is used to disable color. It's used to call color.NoColor later on. But this call uses an incorrect boolean 'no-color' rather than 'disable-color'

Is it possible to add a flag to exclude certain paths? We would like to avoid scanning large directories with data files that reside in the same root path with the applications. thank you for your great work

I tried scanning a docker image and it is showing it vulnurable but log4j version 2.17.0 is used

[!][ ] found org/apache/logging/log4j/core/lookup/JndiLookup.class with hash xxxxxxxxxxx (identified as version(s): 2.17.0, 2.17.1) └───────> found in WEB-INF/lib/log4j-core-2.17.0.jar
└───────> found in opt/app/app.war hash=xxxxxxxxxxx
└───────> found in xxxxxxxxxx/layer.tar