/
Troubleshooting CVE-Check CVE-2021-44228 Log4j is crashing on Windows

Troubleshooting CVE-Check CVE-2021-44228 Log4j is crashing on Windows

Owned by Anastasios Thomaidis

This article helps troubleshoot why the CVE-Check for Log4j crashes on Windows systems.

LAST TESTED ON CHECKMK 2.3.0P1

Table of Contents

Problem

Together with a customer, we figured out a crash of the CVE-2021-44228 Log4j Checkmk from the Checkmk Exchange Site: CVE-2021-44228-log4j scanner plugin

Screenshot of CVE-2021-44228-log4j service in an Unknown state.

Screenshot of a crash report stating TypeError not supported between instances of tuple and int.


The problem seems to be the incomplete agent output:

<<<cve_2021_44228_log4j:sep(0):cached(1640096053,86400)>>>
2021-12-21T15:14:13+01:00
SCAN OPTIONS: --all-drives
<<<>>>


Solution

Let's debug this further on the Windows machine:

The Powershell script returns only the incomplete output. That's why we need to execute the log4j2-scan.exe

Screenshot of log4j2-scan.exe with a vcruntime104.dll was not found.

To solve this, you can use this manual: vcruntime140.dll was not found