CVE-2021-44228-Scanner: unable to report-csv or custom csv report path on windows at least

Hi there, firstly, thanks for this hard work, its great!

I was doing some testing and I am using OpenJDK 11 latest JRE compressed zip file to run the jar file. Windows 2012 R2 and 2016 are hitting a problem and unable to export CSV, here is the debug log. Using the exact same scanner version and exact same OpenJDK 11 JRE on Windows 10 tho does not exhibit this issue and I get the expected CSV output.

EDIT: I ran the exact same command on working Windows 10 system, and I have the exact same error as on the Server OS’s however the CSV file generates just fine. Intriguing!

Can you please assist? Thanks again!

Download page: https://adoptium.net/releases.html?variant=openjdk11&jvmVariant=hotspot Direct download link: https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.13%2B8/OpenJDK11U-jre_x64_windows_hotspot_11.0.13_8.zip

c:\Users\mario\Desktop>"c:\Users\mario\Desktop\log4j_scan\openjdk\jdk-11.0.13+8-jre\bin\java.exe" -jar "c:\Users\mario\Desktop\log4j_scan\logpresso-log4j2-scan-1.7.0.jar" --drives C --silent --report-csv --debug

java.io.IOException: Cannot run program "df": CreateProcess error=2, The system cannot find the file specified
	at java.base/java.lang.ProcessBuilder.start(Unknown Source)
	at java.base/java.lang.ProcessBuilder.start(Unknown Source)
	at java.base/java.lang.Runtime.exec(Unknown Source)
	at java.base/java.lang.Runtime.exec(Unknown Source)
	at java.base/java.lang.Runtime.exec(Unknown Source)
	at com.logpresso.scanner.LinuxPartitionLoader.getPartitions(LinuxPartitionLoader.java:34)
	at com.logpresso.scanner.LinuxPartitionLoader.getExcludePaths(LinuxPartitionLoader.java:24)
	at com.logpresso.scanner.Log4j2Scanner.parseArguments(Log4j2Scanner.java:316)
	at com.logpresso.scanner.Log4j2Scanner.run(Log4j2Scanner.java:101)
	at com.logpresso.scanner.Log4j2Scanner.main(Log4j2Scanner.java:87)
Caused by: java.io.IOException: CreateProcess error=2, The system cannot find the file specified
	at java.base/java.lang.ProcessImpl.create(Native Method)
	at java.base/java.lang.ProcessImpl.<init>(Unknown Source)
	at java.base/java.lang.ProcessImpl.start(Unknown Source)
	... 10 more
Logpresso CVE-2021-44228 Vulnerability Scanner 1.7.0 (2021-12-17)

Scanned 22706 directories and 108838 files
Found 0 vulnerable files
Found 0 potentially vulnerable files
Found 0 mitigated files
Completed in 9.30 seconds

About this issue

  • Original URL
  • State: closed
  • Created 3 years ago
  • Comments: 19 (6 by maintainers)

Most upvoted comments

@tp111 Released new v2.1.1 with --no-empty-report option. It also support new exit code!

@romestylez As you can see https://github.com/logpresso/CVE-2021-44228-Scanner/releases/tag/v2.1.1

  • -1 failed to run
  • 0 for clean (No vulnerability)
  • 1 for found
  • 2 for found but some errors
  • Use --old-exit-code for legacy automation.

You dont need to change yours as you had to work with empty log files from the beginning like everyone 😉 The new option forces everyone to edit the scripts.

Well, thankfully we will get a option to choose 😃

@tp111 Okay. then I will add another option.

Exit codes arent working very well and i dont want to change all the scripts we made again just because there is no more logfile.