Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-45105: A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non-default Pattern Layout with a Context Lookup. Attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup and can cause Denial of Service.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | aws-kinesis-agent | 0:2.0.5-1.amzn2 |
Vulnerabilities 1
-
Medium 5.9
Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a craf…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-45105.html