As we all know, at least four or five Log4j JAR files end up being in the classpath. How can I tell which version I am using?
10 Answers
I came here after learning my servers may be vulnerable to the new Log4j exploit (CVE-2021-44228). So I needed to know whether I had an outdated/vulnerable build of Log4j version 2 installed.
Previous answers here do not help with detecting old versions, because they are for letting already-running Java code figure out which version of Log4j that code uses, whereas I need to know if any Java app could be using a vulnerable version.
Here's what I did instead:
sudo find / -name 'log4j*'
This lists all Log4j related files on my (Linux) server. That showed me a few 1.x versions, which are not vulnerable to this specific CVE, and one 2.15.0 file, which already contains the fix for the CVE.
If you run this and find file or folder names that have 2.x, where x < 15, then you are likely vulnerable, and need to figure out how to update your files ASAP.
Caution
I was warned that this is not enough of a test for my purpose because the Log4j files may be hidden inside a .jar file, which the find
command would not discover.
Update
Here's a public project that attempts to scan all .jar files, in order to find Log4j code inside archives as well: Log4-detector
-
21To list all JAR files on your system containing the vulnerable class file (even in fat JARs), you can use:
for f in $(find / -name '*.jar' 2>/dev/null); do echo "Checking $f..."; unzip -l "$f" | grep -F org/apache/logging/log4j/core/lookup/JndiLookup.class; done
– DelthasDec 13, 2021 at 10:55 -
6Please note that Log4j v1 also can be affected: nvd.nist.gov/vuln/detail/CVE-2019-17571– Ma KobiDec 13, 2021 at 13:13
-
2Log4j 1.x has other vulnerabilities. stackoverflow.com/a/70405229/1329426 .– JoolDec 18, 2021 at 16:44
-
@Delthas Are you sure that looking for the presence of JndiLookup.class is a correct check? Newer (fixed) versions of log4j2 still include that file, albeit with the bug removed– golimarMar 22, 2022 at 13:34
-
1@golimar Indeed, files that were fixed will be listed as well. The command I posted will help you find JARs that are potentially vulnerable but won't tell you if they use the patched version of Log4j or a vulnerable one.– DelthasMar 22, 2022 at 22:03
It depends on the ClassLoader, but have a look at the example:
import org.apache.log4j.Layout;
public class X {
public static void main(String[] a) {
Package p = Layout.class.getPackage();
System.out.println(p);
System.out.println("Implementation title: " + p.getImplementationTitle());
System.out.println("Implementation vendor: " + p.getImplementationVendor());
System.out.println("Implementation version: " + p.getImplementationVersion());
}
}
You can call the method getImplementationVersion
on the Layout
class of log4j:
org.apache.log4j.Layout.class.getPackage().getImplementationVersion()
-
2Great answer and maybe correct, but I get all nulls for that class. The documentation provided by you says it works with 1.2 and 1.3. That might mean that I am using version 2. May 25, 2016 at 13:54
-
2I downloaded a more recent version of Log4j (2.13.1) & found that the
getImplementationVersion
&getSpecificationVersion
methods do work with it. For older versions, see my answer below. Apr 19, 2020 at 0:04 -
The link given in the answer is broken. Can somebody share the example code to print the log4j version programmatically?. Dec 13, 2021 at 16:43
I wouldn't expect this to be the preferred method, but it is how I determined the version of Log4j that my software was using:
Open, or extract the contents of, the Log4j .jar using a .zip archiving utility (Windows Explorer supports this). Navigate into the "META-INF" sub-directory and open the file "MANIFEST.MF" in a text editor. Find the line starting with "Implementation-Version", this is the Log4j version.
Obviously, this is not a programmatic solution. But if you simply want to know what version you are using and you have the .jar archive, it works.
I noticed that Package.getSpecificationVersion()
and Package.getImplementationVersion()
, as mentioned in Loic M.'s answer, work for other .jar libraries, but not my Log4j. It's possible that the version I am using just doesn't support it.
I downloaded version 2.13.1 to try out the above mentioned methods and found that they do work with it. So it was my version (1.2.16) that didn't support them and returned null
.
To know the Log4j version during runtime in Java:
LOGGER.info("Log4j version: " + org.apache.logging.log4j.util.PropertiesUtil.class.getPackage().getImplementationVersion());
Or
System.out.println("Log4j version: " + org.apache.logging.log4j.util.PropertiesUtil.class.getPackage().getImplementationVersion());
-
This will usually work but it can fail in, for example, this case: one of the JARs added to my project is Apache Tika (tika-app-2.3.0.jar) which includes log4j 2.17 (as unpacked .class files, not in a JAR). This line will output 2.3.0 and not 2.17– golimarMar 22, 2022 at 13:25
I've written a small Bash script to check versions of each Log4j JAR file located on that server. It reads the version information from the manifest file, since trusting in file names is a little risky.
locs=( $(sudo find / -name 'log4j*'|grep jar) )
fcount=${#locs[@]}
echo "Found $fcount jar files"
echo " "
for (( j=0; j<${fcount}; j++ ));
do
unzip ${locs[$j]} META-INF/MANIFEST.MF
mv META-INF/MANIFEST.MF META-INF/MANIFEST$j.MF
done
echo " "
for (( j=0; j<${fcount}; j++ ));
do
echo ${locs[$j]}
tail -2 META-INF/MANIFEST$j.MF
done
-
4Probably run shellcheck.net and fix the various problems it reports. Just looping over the
find
output as it arrives would avoid the multiple problems you have with arrays. Briefly,sudo find / -name 'log4j*.jar' -exec sh -c '... your loop code here ...' _ {} +
– tripleeeDec 23, 2021 at 10:20
Because there are multiple versions of same classes from different Log4j dependencies, any of them could get loaded during runtime (given that same class name is present in different JAR files).
I use plugins provided by Eclipse and IntelliJ IDEA to see the Maven dependency tree. Then I exclude the older ones to have only the needed Log4j version.
Delete all the JAR files of the versions you don't need (one should be enough) and to find out the version of the one that’s left, look at the filename.
For example:
log4j-1.2.17.jar
Look inside the core.jar -> log4j-core .zip\META-INF\maven\org.apache.logging.log4j\log4j-core\pom files shows the version
An easy way to do this:
- Put a debug breakpoint at log.debug()
- Step 'into' next statement to determine the class which is called.
- Check the JAR version of the called class.
Bearing in mind the Log4j 2 Security Vulnerability CVE-2021-45105: On Linux and macOS you can use Syft to generate a software bill of materials (SBOM) and Grype to scan for vulnerabilities. Used in combination, you can find where risky versions of Log4j exist, which versions you have and get a report on the vulnerabilities.
Apache recommend ditching Log4j 1, and at least use their 'bridge', log4j-1.2-api, to call Log4j 2 from applications which contain 1.x calls.