Which service still ships Log4Shell?
Search three CycloneDX SBOMs with jq for log4j-core, compare each version with the fixed release, and name the one service that still bundles a vulnerable copy.
Briefing
A new scanner rule asks every team to prove they no longer ship log4j-core older than 2.17.1 (CVE-2021-44228 and its follow-ups). Each build publishes a CycloneDX SBOM listing its components.
jq can search all of them at once: each component has group, name, version, and a package URL (purl).
appsec-ws · Supply chain
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.