CVE-2022-0070

CVE-2022-0070 concerns an issue in the Apache Log4j 2.x hotpatch package (log4j-cve-2021-44228-hotpatch) used on Amazon Linux platforms. The connected advisories describe a race condition in hotpatch versions prior to 1.3-5 that could enable local privilege escalation, by the hotpatcher executing...

CVE-2021-3100

Technical details for CVE-2021-3100 are not publicly provided in the supplied documents. Monitor for updates from connected sources to obtain affected products, root cause, impact, and remediations.

CVE-2021-3100 Log4j hot patch package privilege escalation

The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges...

CVE-2021-3100

The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges...

CVE-2022-0070

Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to...

Hotdog 安全漏洞

Hotdog is a set of OCI hooks for injecting Log4j Hot Patch into containers. An elevation of privilege vulnerability exists prior to Hotdog version 1.0.1 that stems from not mimicking the functionality of the target JVM process or SELinux tags. An attacker could use this vulnerability to allow...

Hotdog 安全漏洞

Hotdog is a set of OCI hooks for injecting Log4j Hot Patch into containers. A resource management error vulnerability exists in Hotdog versions prior to v1.0.2, which arises from an application that does not effectively perform resource limiting, device limiting, or syscall filters on the target...

Amazon Linux 2 : log4j-cve-2021-44228-hotpatch (ALAS-2022-1773)

The version of log4j-cve-2021-44228-hotpatch installed on the remote host is prior to 1.1-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1773 advisory. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic...

PT-2022-2393 · Apache · Log4J

Name of the Vulnerable Software and Affected Versions: Apache Log4j versions prior to log4j-cve-2021-44228-hotpatch-1.1-13 Description: The issue is related to insecure privilege management in the Log4j Java logging program. It allows an attacker to escalate their privileges. Recommendations: For...

Important: log4j-cve-2021-44228-hotpatch

Issue Overview: The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to. In order to mimic the Linux capabilities of the target process, Amazon Linu...

Apache Log4j 安全漏洞

Apache Log4j is a Java-based open source logging tool from the Apache Foundation. Amazon Linux log4j-cve-2021-44228-hotpatch version 1.1-12 previously had a security vulnerability that stemmed from the Apache Log4j hotpatch package prior to log4j-cve-2021-44228-hotpatch-1.1-12 not mimicking the...

Amazon Linux 安全漏洞

Amazon Linux AMI is an application. A supported and maintained Linux image provided by Amazon Web Services for the Amazon Elastic Compute Cloud Amazon EC2. A security vulnerability exists in Amazon Linux 1 and Amazon Linux 2 that stems from an incomplete fix in the log4j-cve-2021-44228-hotpatch...

Important: log4j-cve-2021-44228-hotpatch

Issue Overview: The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to. In order to mimic the Linux capabilities of the target process, Amazon Linu...

Amazon Linux AMI : log4j-cve-2021-44228-hotpatch (ALAS-2022-1580)

The version of log4j-cve-2021-44228-hotpatch installed on the remote host is prior to 1.1-16. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1580 advisory. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic...

Security Bulletin: IBM Informix Dynamic Server is vulnerable to denial of service (CVE-2021-45105) and remote code execution (CVE-2021-45046) due to Apache Log4j

Summary There is a vulnerability in the Apache Log4j open source library used by IBM Informix Dynamic Server for IBM Informix HQ. IBM Informix Dynamic Server is vulnerable to denial of service CVE-2021-45105 and remote code execution CVE-2021-45046 due to Apache Log4j. The fix is included in Apac...

Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to arbitrary code exection due to Apache Log4j (CVE-2022-23307)

Summary IBM Tivoli Netcool Impact which includes the ActiveMQ package is vulnerable to arbitrary code exection due to Apache Log4j CVE-2022-23307 . This has been addressed by updating ActiveMQ to version 5.16.4 which removes Apache Log4j v1 from ActiveMQ. Vulnerability Details CVEID:CVE-2022-2330...

RHEL 8 : Red Hat JBoss Enterprise Application Platform 7.4.4 (RHSA-2022:1297)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1297 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

Trend Micro HouseCall for Home Networks Uncontrolled Search Path Element Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro HouseCall for Home Networks. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.4 (RHSA-2022:1296)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1296 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender

A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain...