Improper Privilege Management Affecting log4j-cve-2021-44228-hotpatch package, versions <0:1.1-16.amzn2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-AMZN2-LOG4JCVE202144228HOTPATCH-2767922
- published 20 Apr 2022
- disclosed 19 Apr 2022
Introduced: 19 Apr 2022
CVE-2022-0070 Open this link in a new tabHow to fix?
Upgrade Amazon-Linux:2 log4j-cve-2021-44228-hotpatch to version 0:1.1-16.amzn2 or higher.
This issue was patched in ALAS2-2022-1773.
NVD Description
Note: Versions mentioned in the description apply only to the upstream log4j-cve-2021-44228-hotpatch package and not the log4j-cve-2021-44228-hotpatch package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2 relevant fixed versions and status.
Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to.