Page Comparison

Info
This article helps troubleshoot why the CVE-Check for Log4j crashes on Windows systems.

Status

colour	Green
title	LAST TESTED ON CHECKMK 2.0.0P1

Panel

Table of Contents

Problem

Together with a customer, we figured out a crash of the CVEthe CVE-2021-44228 -log4j Log4j Checkmk from the Checkmk Exchange Site: https://exchange.checkmk.com/p/cve-2021-44228-log4j

...

Screenshot of CVE-2021-44228-log4j service in an Unknown state. Image Added

...

Screenshot of a crash report stating TypeError not supported between instances of tuple and int. Image Added

Image Removed

The problem seems to be the incomplete agent output:

Code Block

language	bash
theme	RDark

<<<cve_2021_44228_log4j:sep(0):cached(1640096053,86400)>>>
2021-12-21T15:14:13+01:00
SCAN OPTIONS: --all-drives
<<<>>>

Let's debug this further on the Windows machine:

The powershell Powershell script is returning returns only the incomplete output. That's why we need to execute the log4j2-scan.exe

...

bgColor	#fff

...

Screenshot of log4j2-scan.exe with a vcruntime104.dll was not found. Image Added

To solve this, you can use this manual:

...

...

...