Lucene search
AmazonALAS2-2022-1739HistoryJan 18, 2022 - 9:37 p.m.
Medium: log4j
2022-01-1821:37:00
alas.aws.amazon.com
84
Issue Overview:
A flaw was found in the Java logging library Apache Log4j in version 1.x . This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender. This flaw has been filed for Log4j 1.x, the corresponding flaw information for Log4j 2.x is available at: https://access.redhat.com/security/cve/CVE-2021-44228 (CVE-2021-4104)
Affected Packages:
log4j
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update log4j to update your system.
New Packages:
noarch:
log4j-1.2.17-17.amzn2.noarch
log4j-manual-1.2.17-17.amzn2.noarch
log4j-javadoc-1.2.17-17.amzn2.noarch
src:
log4j-1.2.17-17.amzn2.src
Additional References
Red Hat: CVE-2017-5645, CVE-2019-17571, CVE-2021-4104
Mitre: CVE-2017-5645, CVE-2019-17571, CVE-2021-4104
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 2 | noarch | log4j | < 1.2.17-17.amzn2 | log4j-1.2.17-17.amzn2.noarch.rpm |
| Amazon Linux | 2 | noarch | log4j-manual | < 1.2.17-17.amzn2 | log4j-manual-1.2.17-17.amzn2.noarch.rpm |
| Amazon Linux | 2 | noarch | log4j-javadoc | < 1.2.17-17.amzn2 | log4j-javadoc-1.2.17-17.amzn2.noarch.rpm |
Related
nessus
nessus
Amazon Linux 2 : log4j (ALAS-2022-1739)
2023-08-23 00:00:00
Amazon Linux AMI : log4j (ALAS-2022-1562)
2022-01-20 00:00:00
amazon
amazon
Important: log4j
2022-01-18 20:15:00
redhatcve
redhatcve
redhat
redhat
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Apache Log4J
2019-12-25 16:46:11
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-13 19:14:23
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-13 07:48:49
centos
centos
log4j security update
2017-08-31 18:57:53
veracode
veracode
Remote Code Execution (RCE)
2017-04-18 01:36:45
Deserialisation Of Untrusted Object
2021-12-15 13:38:24
Arbitrary Code Execution
2019-12-23 04:57:47
mageia
mageia
Updated davmail packages fix security vulnerability
2023-04-15 22:03:44
osv
osv
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data
2021-12-14 19:49:31
apache-log4j1.2 - security update
2020-01-12 00:00:00
CVE-2019-17571
2019-12-20 17:15:11
ubuntucve
ubuntucve
f5
f5
K24554520 : Apache Log4j Remote Code Execution vulnerability CVE-2021-4104
2021-12-15 00:00:00
K61529042 : Log4j vulnerability CVE-2019-17571
2020-04-08 00:00:00
K23173103 : log4j vulnerability CVE-2017-5645
2018-01-31 00:00:00
ibm
ibm
cvelist
cvelist
CVE-2021-4104 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
2021-12-14 00:00:00
CVE-2017-5645
2017-04-17 21:00:00
CVE-2019-17571
2019-12-20 16:01:21
debiancve
debiancve
atlassian
atlassian
Update Log4J to 1.2.17-atlassian-15 to fix CVE-2021-4104
2022-01-14 13:13:21
Update Log4J to 1.2.17-atlassian-15 to fix CVE-2021-4104
2022-03-07 08:14:14
Apache Log4j - Arbitrary Code Execution in confserver/confluence (master)
2020-03-02 03:58:39
openvas
openvas
Apache Log4j 1.2.x RCE Vulnerability (Windows, Dec 2021) - Version Check
2021-12-17 00:00:00
Huawei EulerOS: Security Advisory for log4j (EulerOS-SA-2022-1276)
2022-03-02 00:00:00
Apache Log4j 1.2.x RCE Vulnerability (Linux/Unix, Dec 2021) - Version Check
2021-12-16 00:00:00
cve
cve
prion
prion
Deserialization of untrusted data
2021-12-14 12:15:00
Deserialization of untrusted data
2019-12-20 17:15:00
Code injection
2017-04-17 21:59:00
github
github
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data
2021-12-14 19:49:31
Deserialization of Untrusted Data in Log4j
2020-01-06 18:43:49
Deserialization of Untrusted Data in Log4j
2020-01-06 18:43:38
attackerkb
attackerkb
CVE-2019-17571
2019-12-20 00:00:00
CVE-2021-44228 (Log4Shell)
2022-02-08 00:00:00
cert
cert
Apache Log4j allows insecure JNDI lookups
2021-12-15 00:00:00
threatpost
threatpost
Apache’s Fix for Log4Shell Can Lead to DoS Attacks
2021-12-15 14:04:19
symantec
symantec
Symantec Security Advisory for Log4j Vulnerability
2021-12-11 01:06:47
Apache Log4j CVE-2017-5645 Remote Code Execution Vulnerability
2017-04-17 00:00:00
trellix
trellix
Log4shell Vulnerability is the Coal in Our Stocking for 2021
2022-01-19 00:00:00
Log4shell Vulnerability is the Coal in Our Stocking for 2021
2022-01-19 00:00:00
seebug
seebug
Apache Log4j socket receiver deserialization vulnerability (CVE-2017-5645)
2017-04-18 00:00:00
fedora
fedora
[SECURITY] Fedora 24 Update: log4j-2.5-3.fc24
2017-05-04 18:26:42
[SECURITY] Fedora 26 Update: log4j-2.7-4.fc26
2017-05-02 15:59:49
[SECURITY] Fedora 24 Update: log4j12-1.2.17-19.fc24
2017-06-12 19:29:11
oraclelinux
oraclelinux
log4j security update
2017-08-09 00:00:00
checkpoint_advisories
checkpoint_advisories
Apache Log4j Remote Code Execution (CVE-2017-5645)
2022-01-02 00:00:00
Apache Log4j Remote Code Execution (CVE-2019-17571)
2020-03-01 00:00:00
debian
debian
[SECURITY] [DLA 2065-1] apache-log4j1.2 security update
2020-01-12 22:27:35
[SECURITY] [DSA 4686-1] apache-log4j1.2 security update
2020-05-15 22:17:02
[SECURITY] [DSA 4686-1] apache-log4j1.2 security update
2020-05-15 22:17:02
cloudlinux
cloudlinux
Fixed CVE-2019-17571 in log4j
2022-06-21 20:23:31
suse
suse
Security update for log4j (important)
2020-01-14 00:00:00
ubuntu
ubuntu
Apache Log4j vulnerability
2020-09-15 00:00:00
thn
thn
New Local Attack Vector Expands the Attack Surface of Log4j Vulnerability
2021-12-18 12:18:00
myhack58
myhack58
qualysblog
qualysblog
CVE-2021-44228: Apache Log4j2 Zero-Day Exploited in the Wild (Log4Shell)
2021-12-10 19:30:11
New Options Profiles for Log4Shell Detection
2021-12-20 17:33:11
rapid7blog
rapid7blog
The Everyperson’s Guide to Log4Shell (CVE-2021-44228)
2021-12-15 19:44:42