ALAS2-2021-1733


Amazon Linux 2 Security Advisory: ALAS-2021-1733
Advisory Release Date: 2021-12-21 02:01 Pacific
Advisory Updated Date: 2021-12-23 19:55 Pacific
Severity: Medium

Issue Overview:

A flaw was found in the Apache Log4j logging library 2.x. when the logging configuration uses a non-default Pattern Layout with a Context Lookup. Attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup and can cause Denial of Service. (CVE-2021-45105)


Affected Packages:

aws-kinesis-agent


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update aws-kinesis-agent to update your system.

New Packages:
noarch:
    aws-kinesis-agent-2.0.5-1.amzn2.noarch

src:
    aws-kinesis-agent-2.0.5-1.amzn2.src