Missing 'known bad' hash for versions <2.1?

[sonotley]

Unless I have misunderstood, this vulnerability affects all versions of log4j from 2.0-beta9 to 2.14.1. I have scanned a directory that contains 2.0.2 and it didn't show up, presumably as there isn't a hash for it. I can supply a hash or a PR if needed.

[yunzheng]

Hi thanks for reporting! it looks like JndiManager.class is not in these versions so it does not show up. We will need to improve our version detection based on other things as well, such as parsing package metadata and hash other classes, etc.

I already started some refactoring based on #51

[sonotley]

Thanks for reply. Based on the info I've read online, the source of the vulnerability is jndiFilter.class, which does exist in 2.0.2.