Skip to content
OpenAdvisories
High ALAS2-2022-1773 1 CVE

Important: log4j-cve-2021-44228-hotpatch security update (Amazon Linux 2)

Published Apr 18, 2022 · Updated Apr 19, 2022

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-0070: The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to. In order to mimic the Linux capabilities of the target process, Amazon Linux 1 customers need to be running kernel version 4.14.275-142.503 or later, while Amazon Linux 2 customers on ARM need to be running kernel versions 4.14.275-207.503, 5.4.188-104.359, 5.10.109-104.500 or later. Amazon Linux 2 customers on Intel or AMD instances do not need an updated kernel.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 log4j-cve-2021-44228-hotpatch 0:1.1-16.amzn2

Vulnerabilities 1

  • High 8.8
    CVE-2022-0070

    Log4j hot patch package privilege escalation

    Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to.

    Amazon Web Services log4j-cve-2021-44228-hotpatch

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-0070.html