Amazon Linux 2 Security Advisory: ALAS-2021-1730
Advisory Release Date: 2021-12-16 00:11 Pacific
Advisory Updated Date: 2021-12-16 04:43 Pacific
Severity:
Critical
Issue Overview:
Amazon Kinesis Agent versions within Amazon Linux 2 (AL2) prior to aws-kinesis-agent-2.0.4-1 included a version of Apache Log4j affected by CVE-2021-44228 and CVE-2021-45046. The Amazon Kinesis Agent has been updated to aws-kinesis-agent-2.0.4-1 within Amazon Linux 2 that mitigates CVE-2021-44228 and CVE-2021-45046. For additional detail see https://github.com/awslabs/amazon-kinesis-agent.
Affected Packages:
aws-kinesis-agent
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update aws-kinesis-agent to update your system.
New Packages:
noarch:
aws-kinesis-agent-2.0.4-1.amzn2.noarch
src:
aws-kinesis-agent-2.0.4-1.amzn2.src