EUVD-2022-15291

Malicious code in bioql PyPI...

Security Bulletin: A Remote Attack Vulnerability in Apache Log4j affects IBM Common Licensing's License Key Server (LKS) Administration And Reporting Tool (ART) and its Agent(CVE-2021-4104,CVE-2021-44832,CVE-2021-3100,CVE-2022-33915).

Summary There is a high risk Remote Attack Vulnerability in Apache Log4j CVE-2021-4104,CVE-2021-44832,CVE-2021-3100,CVE-2022-33915 which is used by IBM LKS Administration And Reporting Tool and its Agent. A fix is available to address the vulnerability. Vulnerability Details CVEID: CVE-2022-33915...

Amazon's Hotpatch for Log4j Flaw Found Vulnerable to Privilege Escalation Bug

The "hotpatch" released by Amazon Web Services AWS in response to the Log4Shell vulnerabilities could be leveraged for container escape and privilege escalation, allowing an attacker to seize control of the underlying host. "Aside from containers, unprivileged processes can also exploit the patch...

CVE-2021-3100

creationtimestamp| type| source ---|---|--- 2022-04-20 02:24:51+00:00| seen| https://t.me/cibsecurity/41158 2022-04-20 14:05:14+00:00| published-proof-of-concept| https://t.me/truesecator/2867 2022-04-20 14:24:03+00:00| published-proof-of-concept| https://t.me/SEReborn/2109 2022-04-20...

Design/Logic Flaw

Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to...

CVE-2021-3100

Technical details for CVE-2021-3100 are not publicly provided in the supplied documents. Monitor for updates from connected sources to obtain affected products, root cause, impact, and remediations.

Amazon Linux 2 : log4j-cve-2021-44228-hotpatch (ALAS-2022-1773)

The version of log4j-cve-2021-44228-hotpatch installed on the remote host is prior to 1.1-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1773 advisory. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic...