# Version
* v36

# Changelog
* 2020-12-14 non-versioned - mitigates CVE-2021-44228
* 2020-12-15 v35 - also resolves CVE-2021-45046
	!!! Customers who used previous version should re-run !!!
* 2020-12-15 v36 - improved README file based on feedback

# About
The Log4jPatcher tool fully mitigates the
following log4j security vulnerabilities:

* CVE-2021-44228
* CVE-2021-45046

It uses techniques recommended in:
https://nvd.nist.gov/vuln/detail/CVE-2021-44228 and
https://www.cve.org/CVERecord?id=CVE-2021-45046.


# Backup
To backup your installation use "--dry run" switch to list all files which will be modified. 
Then manually back them up to safe location.


# How to use
To patch your installation simply download the tool and run it
as is, without any arguments. You need to do this on all servers.

More examples:
(Without any arguments, it defaults to SafeQ installation root stored in Windows
Registry)
.\Log4jPatcher

To provide alternate SafeQ installation root path, use the -p argument:
.\Log4jPatcher -p C:\my_istallation_directory

To test the patching process without actually patching any libraries, you can
invoke the tool with the --dry-run argument:
.\Log4jPatcher --dry-run

The Log4jPatcher tool supports restarting all impacted services
automatically with the --manage-services argument:
.\Log4jPatcher -p C:\my_istallation_directory --manage-services

To get list of all supported command line options, simply run:
.\Log4jPatcher --help

# How does the tool work?
The Log4jPatcher tool is a command line utility and can be run from CMD.EXE, Windows
Terminal or PowerShell. The tool takes installation home directory as an
argument, scans for all versions of log4j library and fixes them. The tool works
correctly on nested .jar and .war archives. It deletes the vulnerable class (JndiLookup.class) 
from all log4j jars that contain it. Tool works on nested jars. It it safe to run 
the tool multiple times against one installation.

# Known Issues or Limitations
When using the --manage-services some services might take more time when
shutting down. If any service gets stuck in the "Service Stopping" state, you
can use Windows Task Manager to kill the relevant service process. The tool with
then proceed automatically.

# Roll back
Stop the services, restore the files from backup, start the services
