Strange "indicator" message from scanner

[Ghepardo]

Hi

The scanner (both versions 0.8.1 and 0.9) gives a strange "indicator" message for one of our JARs:

indicator for vulnerable component found in _<path>_/neo4j-logging-4.3.2.jar (org/neo4j/logging/shaded/log4j/core/net/JndiManager.class): JndiManager class missing new error message string literal

Is this working as intended?

This is probably strongly related to issue #34 .

Kind regards.

[hillu]

From the information you provided, I am pretty sure that this works as intended. Only individual class files are indepcted. Apparently, the JndiManager class does not include the error message introduced after 2.14.1.

Reopen this issue if you know for sure that the embedded copy of log4j is not vulnerable.