Description
The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Amazon Web Services | log4j-cve-2021-44228-hotpatch | unspecified – < 1.1-13 | 1.1-13 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | log4j-cve-2021-44228-hotpatch | 1.1-13.amzn2 | ALAS2-2021-1732 |
Advisories 1
- ALAS2-2021-1732 Important: log4j-cve-2021-44228-hotpatch security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 28, 2022