Description
Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Amazon Web Services | log4j-cve-2021-44228-hotpatch | unspecified – < 1.1-16 | 1.1-16 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | log4j-cve-2021-44228-hotpatch | 1.1-16.amzn2 | ALAS2-2022-1773 |
Advisories 1
- ALAS2-2022-1773 Important: log4j-cve-2021-44228-hotpatch security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 19, 2022