Merge branch 'jsvoboda_CVE-2021-44228_log4j-core' into 'master'

CVE-2021-44228 See merge request Insights/vulnerability-detection-scripts!33
RedHatProductSecurity · Dec 17, 2021 · 6047b5c · 6047b5c
2 parents 2fcbb11 + ac0f6a0
commit 6047b5c
Show file tree

Hide file tree

Showing 21 changed files with 2,898 additions and 0 deletions.
diff --git a/CVE-2021-44228_log4j-core/CVE-2021-44228.sh b/CVE-2021-44228_log4j-core/CVE-2021-44228.sh
diff --git a/CVE-2021-44228_log4j-core/approved_rm_blocks.txt b/CVE-2021-44228_log4j-core/approved_rm_blocks.txt
@@ -0,0 +1,40 @@
+    for required_command in readlink file unzip stat sha256sum basename cat grep uname pwd /bin/rm ; do
+        if ! command -v "$required_command" &> /dev/null; then
+            echo "'$required_command' command is required, but not installed. Exiting."
+            if [[ "$required_command" == "unzip" ]] ; then
+--
+    if [[ -d "$tmp_path/$backtrack/$dir_to_delete" && ! -L "$tmp_path/$backtrack/$dir_to_delete"  ]] ; then
+        if [[ "$dir_to_delete" != *..* && "$dir_to_delete" != */* ]] ; then
+            if [[ "$tmp_path/$backtrack/$dir_to_delete" == "$audit_tmp_path/$backtrack/$dir_to_delete" ]] ; then
+                ( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${backtrack:?}/${dir_to_delete:?}" ; )
+            fi
+        fi
+    fi
+--
+
+
+        if [[ "$tmp_path/$queue" == "$audit_tmp_path/$queue" ]] ; then
+            ( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${queue:?}" ; )
+        fi
+
+        if [[ "$tmp_path/$catalog" == "$audit_tmp_path/$catalog" ]] ; then
+            ( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${catalog:?}" ; )
+        fi
+
+        if [[ "$tmp_path/$decompressed" == "$audit_tmp_path/$decompressed" ]] ; then
+            ( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${decompressed:?}" ; )
+        fi
+
+        if [[ "$tmp_path/$parents" == "$audit_tmp_path/$parents" ]] ; then
+            ( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${parents:?}" ; )
+        fi
+
+        if [[ "$tmp_path/$backtrack" == "$audit_tmp_path/$backtrack" ]] ; then
+            ( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${backtrack:?}" ; )
+        fi
+
+        if [[ "$tmp_path/$detections" == "$audit_tmp_path/$detections" ]] ; then
+            ( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${detections:?}" ; )
+        fi
+
+
diff --git a/CVE-2021-44228_log4j-core/approved_rm_lines.txt b/CVE-2021-44228_log4j-core/approved_rm_lines.txt
@@ -0,0 +1,8 @@
+for required_command in readlink file unzip stat sha256sum basename cat grep uname pwd /bin/rm ; do
+( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${backtrack:?}/${dir_to_delete:?}" ; )
+( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${queue:?}" ; )
+( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${catalog:?}" ; )
+( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${decompressed:?}" ; )
+( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${parents:?}" ; )
+( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${backtrack:?}" ; )
+( cd -- "${audit_tmp_path:?}" && /bin/rm -rf --one-file-system -- "${detections:?}" ; )
diff --git a/CVE-2021-44228_log4j-core/fake_jars.tar.gz b/CVE-2021-44228_log4j-core/fake_jars.tar.gz
diff --git a/CVE-2021-44228_log4j-core/fake_jars_delete.sh b/CVE-2021-44228_log4j-core/fake_jars_delete.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+
+
+rm -rf fake_jars_vuln
+rm -rf fake_jars_nonvuln
+rm -rf fake_jar_test_battery_*
+rm -rf tmp-fake-log4j-core
diff --git a/CVE-2021-44228_log4j-core/fake_jars_generate.sh b/CVE-2021-44228_log4j-core/fake_jars_generate.sh
@@ -0,0 +1,178 @@
+#!/bin/bash
+
+vuln_vers=(
+    '2.0-alpha1'
+    '2.0-alpha2'
+    '2.0-beta1'
+    '2.0-beta2'
+    '2.0-beta3'
+    '2.0-beta4'
+    '2.0-beta5'
+    '2.0-beta6'
+    '2.0-beta7'
+    '2.0-beta8'
+    '2.0-beta9'
+    '2.0-rc1'
+    '2.0-rc2'
+    '2.0'
+    '2.0.1'
+    '2.0.2'
+    '2.1'
+    '2.2'
+    '2.3'
+    '2.4'
+    '2.4.1'
+    '2.5'
+    '2.6'
+    '2.6.1'
+    '2.6.2'
+    '2.7'
+    '2.8'
+    '2.8.1'
+    '2.8.2'
+    '2.9.0'
+    '2.9.1'
+    '2.10.0'
+    '2.11.0'
+    '2.11.1'
+    '2.11.2'
+    '2.12.0'
+    '2.12.1'
+    '2.13.0'
+    '2.13.1'
+    '2.13.2'
+    '2.13.3'
+    '2.14.0'
+    '2.14.1'
+    '2.2.0.redhat-1'
+    '2.2.0.redhat-2'
+    '2.5.0.redhat-1'
+    '2.5.0.redhat-2'
+    '2.5.0.redhat-3'
+    '2.8.0.redhat-1'
+    '2.8.2.redhat-1'
+    '2.8.2.redhat-002'
+    '2.11.1.redhat-00001'
+    '2.11.2.redhat-00002'
+    '2.13.1.redhat-00001'
+    '2.13.2.redhat-00001'
+    '2.13.2.redhat-00002'
+    '2.13.3.redhat-00001'
+    '2.13.3.redhat-00002'
+    '2.13.3.redhat-00003'
+    '2.14.0.redhat-00002'
+    '2.14.0.redhat-00004'
+)
+
+non_vuln_vers=(
+    '1.2.3'
+    '2.12.2'  # https://logging.apache.org/log4j/log4j-2.12.1/
+    '2.15.0'
+    '2.16.0'
+    '2.123.456'
+)
+
+POM_PATH="META-INF/maven/org.apache.logging.log4j/log4j-core/pom.xml"
+POM_DIR="META-INF/maven/org.apache.logging.log4j/log4j-core"
+
+rm -rf fake_jars_vuln
+rm -rf fake_jars_nonvuln
+
+mkdir -p fake_jars_vuln
+mkdir -p fake_jars_nonvuln
+
+for ver in "${vuln_vers[@]}" ; do
+    (
+        rm -rf tmp-fake-log4j-core
+        mkdir tmp-fake-log4j-core
+        cd tmp-fake-log4j-core || { echo "that's weird" ; exit 1 ; }
+        mkdir -p "$POM_DIR"
+        echo "
+        ...something something something something...
+        <modelVersion>4.0.0</modelVersion>
+        <parent>
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j</artifactId>
+        <version>$ver</version>
+        <relativePath>../</relativePath>
+        </parent>
+        ...something something something something...
+        " > "$POM_PATH"
+        dd if=/dev/zero of=filler bs=1024 count=301
+        zip -0 -r ../fake_jars_vuln/log4j-core-"$ver".zip META-INF filler
+        cd ..
+        rm -rf tmp-fake-log4j-core
+    )
+done
+
+
+for ver in "${non_vuln_vers[@]}" ; do
+    (
+        rm -rf tmp-fake-log4j-core
+        mkdir tmp-fake-log4j-core
+        cd tmp-fake-log4j-core || { echo "that's weird" ; exit 1 ; }
+        mkdir -p "$POM_DIR"
+        echo "
+        ...something something something something...
+        <modelVersion>4.0.0</modelVersion>
+        <parent>
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j</artifactId>
+        <version>$ver</version>
+        <relativePath>../</relativePath>
+        </parent>
+        ...something something something something...
+        " > "$POM_PATH"
+        dd if=/dev/zero of=filler bs=1024 count=301
+        zip -0 -r ../fake_jars_nonvuln/log4j-core-"$ver".zip META-INF filler
+        rm -rf tmp-fake-log4j-core
+    )
+done
+
+rm -rf fake_jar_test_battery_*
+
+# expected 61 detections
+mkdir -p fake_jar_test_battery_1
+cp -R fake_jars_vuln fake_jars_nonvuln fake_jar_test_battery_1/
+
+# expected 0 detections
+mkdir -p fake_jar_test_battery_2
+cp -R fake_jars_nonvuln fake_jar_test_battery_2/
+
+# expected 61 detections
+mkdir -p fake_jar_test_battery_3
+zip -0 -r fake_jar_test_battery_3/zip.jar fake_jar_test_battery_1 fake_jar_test_battery_2
+
+# expected 183 detections
+mkdir -p fake_jar_test_battery_4
+zip -0 -r fake_jar_test_battery_4/zip.zip fake_jar_test_battery_1 fake_jar_test_battery_2 fake_jar_test_battery_3
+cp -R fake_jars_vuln fake_jars_nonvuln fake_jar_test_battery_4/
+
+
+# expected 1 detection
+mkdir -p fake_jar_test_battery_smoke_1
+cp -R fake_jars_vuln/log4j-core-2.0.zip fake_jars_nonvuln/log4j-core-2.16.0.zip fake_jar_test_battery_smoke_1/
+
+# expected 0 detections
+mkdir -p fake_jar_test_battery_smoke_2
+cp -R fake_jars_nonvuln/log4j-core-2.16.0.zip fake_jar_test_battery_smoke_2/
+
+# expected 1 detection
+mkdir -p fake_jar_test_battery_smoke_3
+zip -0 -r fake_jar_test_battery_smoke_3/zip.jar fake_jar_test_battery_smoke_1 fake_jar_test_battery_smoke_2
+
+# expected 3 detections
+mkdir -p fake_jar_test_battery_smoke_4
+zip -0 -r fake_jar_test_battery_smoke_4/zip.zip fake_jar_test_battery_smoke_1 fake_jar_test_battery_smoke_2 fake_jar_test_battery_smoke_3
+cp -R fake_jars_vuln/log4j-core-2.0.zip fake_jars_nonvuln/log4j-core-2.16.0.zip fake_jar_test_battery_smoke_4/
+
+# expected 4 detections
+mkdir -p fake_jar_test_battery_smoke_5/f4
+mkdir -p fake_jar_test_battery_smoke_5/f3
+mkdir -p fake_jar_test_battery_smoke_5/f2
+mkdir -p fake_jar_test_battery_smoke_5/f1
+cp -R fake_jars_vuln/log4j-core-2.0.zip fake_jar_test_battery_smoke_5/f4/
+zip -0 -r fake_jar_test_battery_smoke_5/f3/zipf3.jar fake_jar_test_battery_smoke_5/f4
+zip -0 -r fake_jar_test_battery_smoke_5/f2/zipf2.zip fake_jar_test_battery_smoke_5/f3
+zip -0 -r fake_jar_test_battery_smoke_5/f1/zipf1.jar fake_jar_test_battery_smoke_5/f2
+
diff --git a/CVE-2021-44228_log4j-core/fake_jars_pack.sh b/CVE-2021-44228_log4j-core/fake_jars_pack.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+
+rm -rf fake_jars.tar.gz
+tar -czf fake_jars.tar.gz fake_jars_vuln fake_jars_nonvuln fake_jar_test_battery_* tmp-fake-log4j-core
diff --git a/CVE-2021-44228_log4j-core/fake_jars_unpack.sh b/CVE-2021-44228_log4j-core/fake_jars_unpack.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+
+rm -rf fake_jars_vuln
+rm -rf fake_jars_nonvuln
+rm -rf fake_jar_test_battery_*
+rm -rf tmp-fake-log4j-core
+tar -xf fake_jars.tar.gz
+
+
diff --git a/CVE-2021-44228_log4j-core/results_fake_jar_test_battery_1.sha b/CVE-2021-44228_log4j-core/results_fake_jar_test_battery_1.sha
@@ -0,0 +1,61 @@
+e4010634e316a1554ea4ca3471f33aaf01941a3ba16639941ed5db0a2afa003e  test_integration_tmp/report/vuln_log4j2_path_03d02af5ca3463db.txt
+9403b04d3c650cc74051d2b082a165bb812922de79f0e5c43aa432e2031e74a9  test_integration_tmp/report/vuln_log4j2_path_06052543def5c5e0.txt
+0f0c93a2f217fee14cab668771ad8f60c420d6e671b378aeb49f504b2413b4f3  test_integration_tmp/report/vuln_log4j2_path_0f6d03e02acbfd82.txt
+4ddfb93efcc1dc56ffde84503bf7d0f3d7fe12de869c519fedf0cf60d920bb99  test_integration_tmp/report/vuln_log4j2_path_15c75160235e9e75.txt
+013b2494a25c1ef1046774c600f0c782fed58173297512c2a3f537f89bdfd4fe  test_integration_tmp/report/vuln_log4j2_path_1629699373150cc6.txt
+a3d6f9dc77219e1a170f0b4481ad67514234b0f0cc2ecc9a665d13de4020b92a  test_integration_tmp/report/vuln_log4j2_path_1baf2940680d24f3.txt
+ca0bf3a6e11f8835b13c5a0eba9a5858867abc4d0d1da10e815fb31a70489253  test_integration_tmp/report/vuln_log4j2_path_1e96c1a3cf3f46a4.txt
+943401649027b07d96b7e2be614aad0af277e6fa906540263b4d5c0ab185264b  test_integration_tmp/report/vuln_log4j2_path_218f52359b313788.txt
+050741e1bdf2f42c016bbebad96e5d6d915743e35060a729c3ea95db445fdfe4  test_integration_tmp/report/vuln_log4j2_path_2f56422fd3d8dce8.txt
+b19c32499e6dd4b4254280748075a7e946480fe86c14b1f1f09cf67ee3b5ef36  test_integration_tmp/report/vuln_log4j2_path_3173abb3d87e0143.txt
+cf74e2986dc6cbb1f57fbfe7fcbe20a895dd1dad9d5a9ec646735da7bb027359  test_integration_tmp/report/vuln_log4j2_path_31b18655c74fc76d.txt
+8a7ba7e5c04e041cde76931c6298b8011a73d5df5cb3f0a61adbef6664266803  test_integration_tmp/report/vuln_log4j2_path_36ae989cdac58048.txt
+e2fb9ecdc834759a42a4cf5f7c677ab372b610d738242fc263c43335fc3f2758  test_integration_tmp/report/vuln_log4j2_path_3730483e8ca86796.txt
+c13a7586a3a80b5a60914744107afafa7c0187239f058c6f246ec0f21f80cadd  test_integration_tmp/report/vuln_log4j2_path_3b5a82c4a542e870.txt
+d90808fd8c1cbd79d2e9422bdab3df5df4b9850be5a9c8be9f9eb5115a1f0fa5  test_integration_tmp/report/vuln_log4j2_path_416cddc9d02c4f0e.txt
+c6d998e1aaa5ec923814085fe3a46ea548ba2f7bd46051c995aecd467612c551  test_integration_tmp/report/vuln_log4j2_path_4199fc439eaa2219.txt
+1d15903b18a5df938c0e51d4715cc36687a6418a360f0d81da192238d0156e15  test_integration_tmp/report/vuln_log4j2_path_497f584f64b76668.txt
+c0863e5c6fcb79d191afd305a43eda04bcf357740f09f2beaf23323c4e8fc37c  test_integration_tmp/report/vuln_log4j2_path_4a38d79ab2774a73.txt
+fe85f4a57b0ca5d746b4054be52df007a13080ecf9026e8aa5d1f0071748f488  test_integration_tmp/report/vuln_log4j2_path_4f05e15b2ee3c8cc.txt
+21b3f3aec1ca5b35c5f8f536828d0e2bc6b9ae8dfb86a70adb98b765f2da2a3c  test_integration_tmp/report/vuln_log4j2_path_50db5a23389dd871.txt
+103c5b40a4f20a7c179bedeae969850dbc1c0ae2b68013db9c50c07996173341  test_integration_tmp/report/vuln_log4j2_path_5b399762512f00f2.txt
+23e62a44e896895cdff2ab12e95295062602ed197e7f51bd4d7f89af4fe4bed2  test_integration_tmp/report/vuln_log4j2_path_5c51d74d9ce5b560.txt
+3ec577a72e23c9c71be655dcd22cc2d1ad8408d6b35eedff6619b776f90e2a03  test_integration_tmp/report/vuln_log4j2_path_5d37198fdeb5913b.txt
+b09df72eb582a77ad45b80b7753cc75df9bbf0aad7dc62f3b10ec57ec25bddb1  test_integration_tmp/report/vuln_log4j2_path_6518f3b41fe30d03.txt
+9d5d71a72fe7edde2e04c04c76d3b952820c0dc8e4358fd2eb1698efa44e2bbc  test_integration_tmp/report/vuln_log4j2_path_67358eb916ba4c7c.txt
+86fbfa5ac7f8ecf1bc6f1141895971dcb57e729753cadb922f98d1adb2750e7c  test_integration_tmp/report/vuln_log4j2_path_72a499598d17f518.txt
+8e81b90a214cc1d051fa0e95f4dccc94a7f7743689dda27c882cf8efac7b5033  test_integration_tmp/report/vuln_log4j2_path_72b5f9768db0cbde.txt
+f07dea7b2793c631ea1d49d542023215f3fe61dee6531e12a5f8dc77de0a3e62  test_integration_tmp/report/vuln_log4j2_path_762b9b0702762234.txt
+a13ee0e7eb116b2de7d294b5b7776faea5e8fc5cbab6218f68fc2cf5924e5f21  test_integration_tmp/report/vuln_log4j2_path_78d1468f497b477b.txt
+2469dbb61172dff21e38e7667db91eb7e889556bcad2d269a58edd5bf20c43a4  test_integration_tmp/report/vuln_log4j2_path_7932639ab36530f6.txt
+63ff8db556e583f7dbf62a13474f4cf15c0aa5079065f7e60edbd2e3a9cb06a8  test_integration_tmp/report/vuln_log4j2_path_7b63d09989c0f0b8.txt
+1cc3720afc11e72e22519ccea2822c69cb5b2b33ffe350d093569a2615bc7e73  test_integration_tmp/report/vuln_log4j2_path_7f651fe744e64b71.txt
+b196c56db4bdc9110b3fbb2514d9e06f6e72dc0380a61d619748bb6e35f73cdd  test_integration_tmp/report/vuln_log4j2_path_80f06ae3b14925ab.txt
+f91280ed3887d49348ecb64d36fbafec41851b387121722a9a43b63737ce029d  test_integration_tmp/report/vuln_log4j2_path_83b0e061a7ccc02c.txt
+61bc6b39577f2ff8c6e59e484c80a4b29dc94a142d0cb690706df49e71f05d22  test_integration_tmp/report/vuln_log4j2_path_86d8ff4d2b52ff8e.txt
+1522eb9df0aa86c4bf244dec8975cb37b01ac3a7495dfb5ada02d789568a16a5  test_integration_tmp/report/vuln_log4j2_path_86dca1be59d79980.txt
+4715f0755ae040b615b58e25d969b0c3d29faa5e5e7af457dbec10eea79142af  test_integration_tmp/report/vuln_log4j2_path_87e9a37f23339f66.txt
+6dee1bcf301a790cc3245304aa6d0df389a0f61f1776417f929c9856f61c04f6  test_integration_tmp/report/vuln_log4j2_path_8a34f1c004b491db.txt
+bc63c42b8ae7e2e4fdfa6b0191728b28a77ac180e097cdf3cc14e8744859bc94  test_integration_tmp/report/vuln_log4j2_path_8ec4166d6abc0fbe.txt
+ceef4101403805f155b627467083573ca080a9145563592e1f665d3dae039ea7  test_integration_tmp/report/vuln_log4j2_path_9a0000fdb130634f.txt
+d701e0e16a5cd5f2b8270567a0d7c94016994097bb1d12885ba6c2d7e0e3631c  test_integration_tmp/report/vuln_log4j2_path_9a83ecac5ade892f.txt
+fcbb4fc625ae04a24d93e1e809feefabfced0576c25a2458b3f54743c2babfa6  test_integration_tmp/report/vuln_log4j2_path_9edd0055a00fe1b1.txt
+e1b74687ec15ac57b779598bd5fd876c9450b489f79dd2553a7834d6d98abfca  test_integration_tmp/report/vuln_log4j2_path_9f47287993299f57.txt
+4174d1c68155dbb5e2675d7b0591efd2513e8fde5de895dc6c5b2013d1bf12e2  test_integration_tmp/report/vuln_log4j2_path_a25acb22b5eb60a8.txt
+5bf063964693efac0437f9cedca912ac2dbb64bbc269622fedc090edb6f4c8d4  test_integration_tmp/report/vuln_log4j2_path_b1694fb370a46f39.txt
+37ebf033f6805dec60b6a41de32b0735f259a7e52aec3e82d83adbd6cfd6fa29  test_integration_tmp/report/vuln_log4j2_path_b41ee82fac4095e9.txt
+59e5665b2b8bfd3db22f05b35e88a2f8caded663aff940c62f08eaddb7a32743  test_integration_tmp/report/vuln_log4j2_path_be4b249b79da102b.txt
+34f0495126d3ce1887f15795f3c462fbb0652ca4e06ddaea55d44ea05890ae11  test_integration_tmp/report/vuln_log4j2_path_c6f627890822e4be.txt
+0921c2ef2cacdb2e6e476ed62609edfeb12188e67f23ef7618e4ed5c80fc8deb  test_integration_tmp/report/vuln_log4j2_path_cba05cf9d483daa3.txt
+9c9329780bcdf1c088208ee951a189ff09b2e9d335717cdf52edc4f4e76be7c0  test_integration_tmp/report/vuln_log4j2_path_cbbcb336f66fff4a.txt
+005ff6a90db6f489af523e38a26fe928a9825f992fd57f8982880a9b5ea9b315  test_integration_tmp/report/vuln_log4j2_path_d4d3ce0b5c3edbce.txt
+47f57b0af319043b39cc100c18dce5317acaaea3ecca58622c3044961d022872  test_integration_tmp/report/vuln_log4j2_path_d8dcb3917a45f774.txt
+a53481f6b182845834f341e87ec02ed41ebc62a6005d34d4b3e5176d28dfaa51  test_integration_tmp/report/vuln_log4j2_path_e16cb82391de2363.txt
+ae5c0fb63341e826a86b0a3d455b413287d702220271bf9f2752ccf2d30bb233  test_integration_tmp/report/vuln_log4j2_path_e7363321894a469d.txt
+c1f16ea0f351b0069b1b7c7357ba91190f7506108b2e122ceeaf86bf5c72396b  test_integration_tmp/report/vuln_log4j2_path_f022e40757fba59f.txt
+c6238349c66b73e3b7ba179eecd06e280b4b82adb5eb1eed531cac58f314649f  test_integration_tmp/report/vuln_log4j2_path_f0eca2fa460e05bb.txt
+fad3b053df631eab30157c54a6c5ed29dcc5d6552954b9b14fb0c206bc6c0eaa  test_integration_tmp/report/vuln_log4j2_path_f4ea9cd194b9db27.txt
+038772db0bebf4adc4f68f4466e21903866413bdc80e39e8668951e2dbe070ff  test_integration_tmp/report/vuln_log4j2_path_f67de04669e623a8.txt
+621183b989dc50f087f55253737c9849fa7b284c23c915fded7da9ea93fe6997  test_integration_tmp/report/vuln_log4j2_path_f8fcbf11cd975697.txt
+609d69db3d3cc91dd9f3a9740aff53f33a0d4a87f37ea1d6d61b614077681d93  test_integration_tmp/report/vuln_log4j2_path_fa1b2818366b66f3.txt
+9b8315b37c2b6b2a6834a745602cec9fea9a82329a09d2cf5cdf8048499af1aa  test_integration_tmp/report/vuln_log4j2_path_fca1f67c85ea077d.txt