Description
An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute arbitrary commands with root privileges via a Java process whose executable path contains embedded newline characters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Amazon | log4j-cve-2021-44228-hotpatch | < 1.3-9.amzn2 | 1.3-9.amzn2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | log4j-cve-2021-44228-hotpatch | 1.3-9.amzn2 | ALAS2-2026-3784 |
Advisories 1
- ALAS2-2026-3784 Important: log4j-cve-2021-44228-hotpatch security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 21, 2026
References
- https://alas.aws.amazon.com/AL2/ALAS2-2026-3784.html vendor-advisory patch release-notes
- https://aws.amazon.com/security/security-bulletins/2026-098-aws/ vendor-advisory