Lucene search
AmazonALAS2-2021-1731HistoryDec 17, 2021 - 6:12 p.m.
Critical: java-17-amazon-corretto, java-11-amazon-corretto, java-1.8.0-openjdk, java-1.7.0-openjdk
2021-12-1718:12:00
alas.aws.amazon.com
342
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10 High
AI Score
Confidence
High
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.976 High
EPSS
Percentile
100.0%
Issue Overview:
No versions of an Amazon Linux Java Virtual Machine (JVM) are affected by CVE-2021-44228 or CVE-2021-45046. However, if customers load a log4j version that is affected by CVE-2021-44228 or CVE-2021-45046 into an Amazon Linux JVM, it will introduce the issues identified in CVE-2021-44228 and CVE-2021-45046 into the JVM. This update modifies Amazon Linux packages that provide a JVM to also install the AWS-developed hotpatch to mitigate CVE-2021-44228 or CVE-2021-45046 by default. For more information on the hotpatch package in Amazon Linux, see https://alas.aws.amazon.com/announcements/2021-001.html
Affected Packages:
java-17-amazon-corretto, java-11-amazon-corretto, java-1.8.0-openjdk, java-1.7.0-openjdk
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update java-17-amazon-corretto to update your system.
Run yum update java-11-amazon-corretto to update your system.
Run yum update java-1.8.0-openjdk to update your system.
Run yum update java-1.7.0-openjdk to update your system.
New Packages:
aarch64:
java-1.8.0-openjdk-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-1.8.0-openjdk-debug-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-1.8.0-openjdk-headless-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-1.8.0-openjdk-headless-debug-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-1.8.0-openjdk-devel-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-1.8.0-openjdk-devel-debug-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-1.8.0-openjdk-demo-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-1.8.0-openjdk-demo-debug-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-1.8.0-openjdk-src-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-1.8.0-openjdk-src-debug-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-1.8.0-openjdk-accessibility-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-1.8.0-openjdk-accessibility-debug-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-1.8.0-openjdk-debuginfo-1.8.0.312.b07-1.amzn2.0.2.aarch64
java-17-amazon-corretto-17.0.1+12-3.amzn2.1.aarch64
java-17-amazon-corretto-devel-17.0.1+12-3.amzn2.1.aarch64
java-17-amazon-corretto-headless-17.0.1+12-3.amzn2.1.aarch64
java-11-amazon-corretto-11.0.13+8-2.amzn2.aarch64
java-17-amazon-corretto-javadoc-17.0.1+12-3.amzn2.1.aarch64
java-17-amazon-corretto-jmods-17.0.1+12-3.amzn2.1.aarch64
java-11-amazon-corretto-headless-11.0.13+8-2.amzn2.aarch64
java-11-amazon-corretto-javadoc-11.0.13+8-2.amzn2.aarch64
i686:
java-1.7.0-openjdk-1.7.0.261-2.6.22.2.amzn2.0.2.i686
java-1.7.0-openjdk-headless-1.7.0.261-2.6.22.2.amzn2.0.2.i686
java-1.7.0-openjdk-devel-1.7.0.261-2.6.22.2.amzn2.0.2.i686
java-1.7.0-openjdk-demo-1.7.0.261-2.6.22.2.amzn2.0.2.i686
java-1.7.0-openjdk-src-1.7.0.261-2.6.22.2.amzn2.0.2.i686
java-1.7.0-openjdk-accessibility-1.7.0.261-2.6.22.2.amzn2.0.2.i686
java-1.7.0-openjdk-debuginfo-1.7.0.261-2.6.22.2.amzn2.0.2.i686
java-1.8.0-openjdk-1.8.0.312.b07-1.amzn2.0.2.i686
java-1.8.0-openjdk-debug-1.8.0.312.b07-1.amzn2.0.2.i686
java-1.8.0-openjdk-headless-1.8.0.312.b07-1.amzn2.0.2.i686
java-1.8.0-openjdk-headless-debug-1.8.0.312.b07-1.amzn2.0.2.i686
java-1.8.0-openjdk-devel-1.8.0.312.b07-1.amzn2.0.2.i686
java-1.8.0-openjdk-devel-debug-1.8.0.312.b07-1.amzn2.0.2.i686
java-1.8.0-openjdk-demo-1.8.0.312.b07-1.amzn2.0.2.i686
java-1.8.0-openjdk-demo-debug-1.8.0.312.b07-1.amzn2.0.2.i686
java-1.8.0-openjdk-src-1.8.0.312.b07-1.amzn2.0.2.i686
java-1.8.0-openjdk-src-debug-1.8.0.312.b07-1.amzn2.0.2.i686
java-1.8.0-openjdk-accessibility-1.8.0.312.b07-1.amzn2.0.2.i686
java-1.8.0-openjdk-accessibility-debug-1.8.0.312.b07-1.amzn2.0.2.i686
java-1.8.0-openjdk-debuginfo-1.8.0.312.b07-1.amzn2.0.2.i686
noarch:
java-1.7.0-openjdk-javadoc-1.7.0.261-2.6.22.2.amzn2.0.2.noarch
java-1.8.0-openjdk-javadoc-1.8.0.312.b07-1.amzn2.0.2.noarch
java-1.8.0-openjdk-javadoc-zip-1.8.0.312.b07-1.amzn2.0.2.noarch
java-1.8.0-openjdk-javadoc-debug-1.8.0.312.b07-1.amzn2.0.2.noarch
java-1.8.0-openjdk-javadoc-zip-debug-1.8.0.312.b07-1.amzn2.0.2.noarch
src:
java-1.7.0-openjdk-1.7.0.261-2.6.22.2.amzn2.0.2.src
java-1.8.0-openjdk-1.8.0.312.b07-1.amzn2.0.2.src
java-17-amazon-corretto-17.0.1+12-3.amzn2.1.src
java-11-amazon-corretto-11.0.13+8-2.amzn2.src
x86_64:
java-1.7.0-openjdk-1.7.0.261-2.6.22.2.amzn2.0.2.x86_64
java-1.7.0-openjdk-headless-1.7.0.261-2.6.22.2.amzn2.0.2.x86_64
java-1.7.0-openjdk-devel-1.7.0.261-2.6.22.2.amzn2.0.2.x86_64
java-1.7.0-openjdk-demo-1.7.0.261-2.6.22.2.amzn2.0.2.x86_64
java-1.7.0-openjdk-src-1.7.0.261-2.6.22.2.amzn2.0.2.x86_64
java-1.7.0-openjdk-accessibility-1.7.0.261-2.6.22.2.amzn2.0.2.x86_64
java-1.7.0-openjdk-debuginfo-1.7.0.261-2.6.22.2.amzn2.0.2.x86_64
java-1.8.0-openjdk-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-1.8.0-openjdk-debug-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-1.8.0-openjdk-headless-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-1.8.0-openjdk-headless-debug-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-1.8.0-openjdk-devel-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-1.8.0-openjdk-devel-debug-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-1.8.0-openjdk-demo-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-1.8.0-openjdk-demo-debug-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-1.8.0-openjdk-src-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-1.8.0-openjdk-src-debug-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-1.8.0-openjdk-accessibility-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-1.8.0-openjdk-accessibility-debug-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-1.8.0-openjdk-debuginfo-1.8.0.312.b07-1.amzn2.0.2.x86_64
java-17-amazon-corretto-17.0.1+12-3.amzn2.1.x86_64
java-17-amazon-corretto-devel-17.0.1+12-3.amzn2.1.x86_64
java-11-amazon-corretto-11.0.13+8-2.amzn2.x86_64
java-17-amazon-corretto-headless-17.0.1+12-3.amzn2.1.x86_64
java-17-amazon-corretto-javadoc-17.0.1+12-3.amzn2.1.x86_64
java-17-amazon-corretto-jmods-17.0.1+12-3.amzn2.1.x86_64
java-11-amazon-corretto-headless-11.0.13+8-2.amzn2.x86_64
java-11-amazon-corretto-javadoc-11.0.13+8-2.amzn2.x86_64
Additional References
Red Hat: CVE-2021-44228, CVE-2021-45046
Mitre: CVE-2021-44228, CVE-2021-45046
Related
mssecure
mssecure
ibm
ibm
nessus
nessus
Amazon Linux 2 : aws-kinesis-agent (ALAS-2021-1730)
2021-12-16 00:00:00
openSUSE 15 Security Update : log4j (openSUSE-SU-2021:4107-1)
2021-12-17 00:00:00
intel
intel
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Apache Log4J
2022-01-13 03:02:47
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-16 17:22:17
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-13 21:57:58
vmware
vmware
typo3
typo3
Statement on Recent log4j/log4shell Vulnerabilities (CVE-2021-44228)
2021-12-16 00:00:00
openvas
openvas
Openfire < 4.5.5, 4.6.x < 4.6.6 Multiple Log4j Vulnerabilities (Log4Shell)
2021-12-13 00:00:00
Apache Log4j 2.0.x Multiple Vulnerabilities (Linux/Unix, Log4Shell) - Version Check
2021-12-11 00:00:00
openSUSE: Security Advisory for log4j (openSUSE-SU-2021:4107-1)
2022-02-01 00:00:00
osv
osv
Incomplete fix for Apache Log4j vulnerability
2021-12-14 18:01:28
CVE-2021-45046
2021-12-14 19:15:07
Remote code injection in Log4j
2021-12-10 00:40:56
ubuntu
ubuntu
Apache Log4j 2 vulnerability
2021-12-15 00:00:00
kitploit
kitploit
debiancve
debiancve
CVE-2021-45046
2021-12-14 19:15:00
threatpost
threatpost
APT ‘Aquatic Panda’ Targets Universities with Log4Shell Exploit Tools
2021-12-30 16:16:23
Apache’s Fix for Log4Shell Can Lead to DoS Attacks
2021-12-15 14:04:19
prion
prion
Default configuration
2021-12-14 19:15:00
Race condition
2022-06-17 13:15:00
Authorization
2022-08-24 16:15:00
suse
suse
Security update for log4j (important)
2021-12-20 00:00:00
Security update for log4j (important)
2021-12-17 00:00:00
thn
thn
veracode
veracode
Denial Of Service (DoS)
2021-12-15 00:30:50
redhatcve
redhatcve
CVE-2021-45046
2022-05-07 14:27:31
cve
cve
CVE-2021-45046
2021-12-14 19:15:00
CVE-2021-4125
2022-08-24 16:15:00
checkpoint_advisories
checkpoint_advisories
Apache Log4j Remote Code Execution (CVE-2021-44228; CVE-2021-45046)
2021-12-10 00:00:00
talosblog
talosblog
Quarterly Report: Incident Response Trends in Q2 2022
2022-07-26 14:03:00
Quarterly Report: Incident Response Trends in Q3 2022
2022-10-25 12:00:00
fortinet
fortinet
Apache log4j2 log messages substitution (CVE-2021-44228)
2021-12-12 00:00:00
amazon
amazon
Critical: java-1.8.0-openjdk, java-1.7.0-openjdk, java-1.6.0-openjdk
2021-12-17 17:39:00
Critical: aws-kinesis-agent
2021-12-16 00:11:00
redhat
redhat
securelist
securelist
CVE-2021-44228 vulnerability in Apache Log4j library
2021-12-13 14:10:21
Answering Log4Shell-related questions
2021-12-20 15:45:30
nuclei
nuclei
Apache Log4j2 - Remote Code Injection
2021-12-23 15:41:50
attackerkb
attackerkb
CVE-2021-45046
2021-12-14 00:00:00
CVE-2022-33915
2022-06-17 00:00:00
github
github
Incomplete fix for Apache Log4j vulnerability
2021-12-14 18:01:28
Remote code injection in Log4j
2021-12-10 00:40:56
ubuntucve
ubuntucve
CVE-2021-45046
2021-12-14 00:00:00
debian
debian
[SECURITY] [DSA 5022-1] apache-log4j2 security update
2021-12-16 10:29:17
rapid7blog
rapid7blog
How to Protect Your Applications Against Log4Shell With tCell
2021-12-15 14:58:14
impervablog
impervablog
Log4Shell log4j Remote Code Execution – The COVID of the Internet
2022-01-06 16:41:56
mageia
mageia
Updated log4j packages fix security vulnerability
2021-12-19 15:26:08
f5
f5
K32171392 : Apache Log4j2 vulnerability CVE-2021-45046
2021-12-16 00:00:00
freebsd
freebsd
graylog -- remote code execution in log4j from user-controlled log input
2021-11-14 00:00:00
mmpc
mmpc
huawei
huawei
cisa_kev
cisa_kev
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
2023-05-01 00:00:00
malwarebytes
malwarebytes
ics
ics
Mitigating Log4Shell and Other Log4j-Related Vulnerabilities
2021-12-23 12:00:00
qualysblog
qualysblog
How to Discover Log4Shell Vulnerabilities in Running Containers & Images
2021-12-27 19:39:34
symantec
symantec
Symantec Security Advisory for Log4j Vulnerability
2021-12-11 01:06:47
10 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10 High
AI Score
Confidence
High
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.976 High
EPSS
Percentile
100.0%
Related for ALAS2-2021-1731