Medium: log4j

Issue Overview:

A flaw was found in the Java logging library Apache Log4j in version 1.x . This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender. This flaw has been filed for Log4j 1.x, the corresponding flaw information for Log4j 2.x is available at: https://access.redhat.com/security/cve/CVE-2021-44228 (CVE-2021-4104)

Affected Packages:

log4j

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update log4j to update your system.

New Packages:

noarch:  
    log4j-1.2.17-17.amzn2.noarch  
    log4j-manual-1.2.17-17.amzn2.noarch  
    log4j-javadoc-1.2.17-17.amzn2.noarch  
  
src:  
    log4j-1.2.17-17.amzn2.src  

Additional References

Red Hat: CVE-2017-5645, CVE-2019-17571, CVE-2021-4104

Mitre: CVE-2017-5645, CVE-2019-17571, CVE-2021-4104