ALAS2-2022-1739

Amazon Linux 2 Security Advisory: ALAS-2022-1739
Advisory Release Date: 2022-01-18 21:37 Pacific
Advisory Updated Date: 2023-08-17 11:57 Pacific
Severity: Medium
Issue Overview:

A flaw was found in the Java logging library Apache Log4j in version 1.x . This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender. This flaw has been filed for Log4j 1.x, the corresponding flaw information for Log4j 2.x is available at: https://access.redhat.com/security/cve/CVE-2021-44228 (CVE-2021-4104)


Affected Packages:

log4j


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update log4j to update your system.

New Packages:
noarch:
    log4j-1.2.17-17.amzn2.noarch
    log4j-manual-1.2.17-17.amzn2.noarch
    log4j-javadoc-1.2.17-17.amzn2.noarch

src:
    log4j-1.2.17-17.amzn2.src

Additional References

Red Hat: CVE-2017-5645, CVE-2019-17571, CVE-2021-4104

Mitre: CVE-2017-5645, CVE-2019-17571, CVE-2021-4104