Improper Privilege Management Affecting log4j-cve-2021-44228-hotpatch package, versions <0:1.1-13.amzn2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-AMZN2-LOG4JCVE202144228HOTPATCH-2325276
- published 24 Dec 2021
- disclosed 19 Apr 2022
Introduced: 24 Dec 2021
CVE-2021-3100 Open this link in a new tabHow to fix?
Upgrade Amazon-Linux:2 log4j-cve-2021-44228-hotpatch to version 0:1.1-13.amzn2 or higher.
This issue was patched in ALAS2-2021-1732.
NVD Description
Note: Versions mentioned in the description apply only to the upstream log4j-cve-2021-44228-hotpatch package and not the log4j-cve-2021-44228-hotpatch package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2 relevant fixed versions and status.
The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.