This agent fixes critical vulnerability [CVE-2021-44228](https://www.lunasec.io/docs/blog/log4j-zero-day/) in log4j by patching `JndiLookup` class, as recommended [here](https://www.lunasec.io/docs/blog/log4j-zero-day/#temporary-mitigation).
**WARNING: this is not a substitute for proper upgrade to log4j 2.15.0**, where this vulnerability was fixed for good. Use this agent **IF, and ONLY IF, you can't upgrade log4j in your app**.
Agent can run on JRE 8 and higher, in any application (including Minecraft clients and servers).
This will completely disable `JNDI` in log4j. If you need this functionality, do not use this agent.
## How to use
1. Download agent JAR or build it yourself
2. Add command line argument `-javaagent:/path/to/agent/log4j-vulnerability-patcher-agent.jar` to the start command of your app
Example command line:
java -javaagent:/home/user/log4j-vulnerability-patcher-agent.jar -Xmx1G spigot.jar
If everything is OK, on start agent will output `[Log4jVulnerabilityPatcherAgent] JndiLookup was patched, vulnerability fixed!`.
You will need JDK 8, Maven and Git.
git clone https://github.com/saharNooby/log4j-vulnerability-patcher-agent.git
mvn clean package