CVE-2022-0070

Log4j hot patch package privilege escalation

CVSS 8.8 HIGHEPSS 0.4%CWE-250

Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Produtos afetados

Amazon Web Services · log4j-cve-2021-44228-hotpatch

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://alas.aws.amazon.com/cve/html/CVE-2022-0070.html https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities