Skip to content
OpenAdvisories
Critical 2 exploited CVEs ALAS2-2021-1731 2 CVEs

Critical: java-17-amazon-corretto security update (Amazon Linux 2)

Published Dec 17, 2021 · Updated Dec 17, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-45046: It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a denial of service (DOS) attack. Log4j 2.15.0 makes a best-effort attempt to restrict JNDI LDAP lookups to localhost by default. Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. CVE-2021-44228: A flaw was found in the Java logging library Apache Log4j 2 in versions from 2.0-beta9 and before and including 2.14.1. This could allow a remote attacker to execute code on the server if the system logs an attacker-controlled string value with the attacker's JNDI LDAP server lookup.

Fixed packages 33

ReleasePackageFixed in
Amazon Linux · 2 java-1.7.0-openjdk 1:1.7.0.261-2.6.22.2.amzn2.0.2
Amazon Linux · 2 java-1.7.0-openjdk-accessibility 1:1.7.0.261-2.6.22.2.amzn2.0.2
Amazon Linux · 2 java-1.7.0-openjdk-debuginfo 1:1.7.0.261-2.6.22.2.amzn2.0.2
Amazon Linux · 2 java-1.7.0-openjdk-demo 1:1.7.0.261-2.6.22.2.amzn2.0.2
Amazon Linux · 2 java-1.7.0-openjdk-devel 1:1.7.0.261-2.6.22.2.amzn2.0.2
Amazon Linux · 2 java-1.7.0-openjdk-headless 1:1.7.0.261-2.6.22.2.amzn2.0.2
Amazon Linux · 2 java-1.7.0-openjdk-javadoc 1:1.7.0.261-2.6.22.2.amzn2.0.2
Amazon Linux · 2 java-1.7.0-openjdk-src 1:1.7.0.261-2.6.22.2.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-accessibility 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-accessibility-debug 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-debug 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-debuginfo 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-demo 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-demo-debug 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-devel 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-devel-debug 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-headless 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-headless-debug 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-javadoc 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-javadoc-debug 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-javadoc-zip 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-javadoc-zip-debug 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-src 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-1.8.0-openjdk-src-debug 1:1.8.0.312.b07-1.amzn2.0.2
Amazon Linux · 2 java-11-amazon-corretto 1:11.0.13+8-2.amzn2
Amazon Linux · 2 java-11-amazon-corretto-headless 1:11.0.13+8-2.amzn2
Amazon Linux · 2 java-11-amazon-corretto-javadoc 1:11.0.13+8-2.amzn2
Amazon Linux · 2 java-17-amazon-corretto 1:17.0.1+12-3.amzn2.1
Amazon Linux · 2 java-17-amazon-corretto-devel 1:17.0.1+12-3.amzn2.1
Amazon Linux · 2 java-17-amazon-corretto-headless 1:17.0.1+12-3.amzn2.1
Amazon Linux · 2 java-17-amazon-corretto-javadoc 1:17.0.1+12-3.amzn2.1
Amazon Linux · 2 java-17-amazon-corretto-jmods 1:17.0.1+12-3.amzn2.1

Vulnerabilities 2

  • Critical 10.0
    CVE-2021-44228 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …

    Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV Dec 10, 2021
  • Critical 9.0
    CVE-2021-45046 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

    It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…

    Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV May 1, 2023

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-44228.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-45046.html