Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3100: The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-13 will now explicitly mimic the permissions of the JVM attempting to be updated.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | log4j-cve-2021-44228-hotpatch | 0:1.1-13.amzn2 |
Vulnerabilities 1
-
High 8.8
Log4j hot patch package privilege escalation
The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-3100.html