WhiteSource Log4j Detect scans projects to find vulnerable Log4j versions

WhiteSource launched WhiteSource Log4j Detect, a free command-line interface (CLI) tool to help organizations quickly detect and remediate the Log4j vulnerabilities CVE-2021-44228 and CVE-2021-445046.

This free developer tool, which is hosted on GitHub and is now available for use, quickly scans projects to find vulnerable Log4j versions and provides the exact path — both to direct or indirect dependencies — along with the fixed version for speedy remediation.

As a standalone tool, developers can download the utility that matches their platform, run it within the terminal, and run the scan command on the root folder of the project.

“By offering this free tool to developers and their teams, we aim to help organizations address these vulnerabilities, and mitigate their impact,” said Rami Sass, co-founder, and CEO of WhiteSource. “It’s important for us to provide security and DevOps teams the tools that they need to address new threats. Adopting a remediation-first approach and baking security automation into development is the best way to proactively address new and emerging risks to today’s software development organizations.”