scan error: zip END header not found about cve-2021-44228-scanner HOT 7 CLOSED

I get:

c:\Miracle_online>log4j2-scan.exe D:\Oracle\product\12.2.0\dbhome_1\md
scan error: zip END header not found
scan error: zip END header not found
scan error: zip END header not found

Scanned 18 directories and 616 files
Found 0 vulnerable files
Completed in 3.73 seconds

And I know 4 sure the some files are hit here:

Directory of D:\Oracle\product\12.2.0\dbhome_1\md\jlib

14-12-2021 15:58

from cve-2021-44228-scanner.

I tried with new package and gets below details:

c:\temp>log4j2-scan.exe c:\ManageEngine
Logpresso CVE-2021-44228 Vulnerability Scanner 1.3.0 (2021-12-15)
Skipping broken jar file c:\ManageEngine\SupportCenter\applications\extracted.ol
d\AdventNetSupportCenter.eear\AdventNetServiceDeskWC.ear\AdventNetServiceDesk.wa
r\WEB-INF\lib\jfreechart.jar ('zip END header not found')

super useful information, thanks folks for doing this.

from cve-2021-44228-scanner.

@AlexMilotin If application uses common class loader, you don't need to inspect zip files. Ordinary programmers do not write thier own classloader for thier use. Valid ZIP file should starts with PK (0x50 0x4b) bytes like this:

However, JDK does not fully support newer ZIP standards (As I referenced in release note: Avoid ZipInputStream for flat ZIP files: https://bugs.openjdk.java.net/browse/JDK-8143613) JDK cannot open some ZIP files which can be opened by other zip utility programs.

Anyway, In most cases, you don't need to inspect zip files.

from cve-2021-44228-scanner.

I have the same issue til log44 jars in oracle home

from cve-2021-44228-scanner.

same here, I can see log4j.jar in directory, but seems it cannot read it somehow.

PS C:\temp> .\log4j2-scan.exe C:\ManageEngine
scan error: zip END header not found

Scanned 50994 directories and 85903 files
Found 0 vulnerable files
Completed in 56.59 seconds

from cve-2021-44228-scanner.

@kiasalimielizi @Mettemusens You can find broken jar files using v1.3.0 release.

from cve-2021-44228-scanner.

How does a broken .jar is actually defined? based on what?
A short example from my side

I did unpacked some random of archived which were in this category and they do not contain .jar files within them.
Would be it be then safe to assume that all those with ('zip END header not found') can be ignored ?

from cve-2021-44228-scanner.