CVE-2021-3100: Log4j hot patch package privilege escalation
First published: Tue Apr 19 2022(Updated: )
The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.
Credit: psirt@paloaltonetworks.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Amazon Log4jhotpatch | <1.1-13 | |
| Linux Linux kernel |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Apache Log4j hotpatch package vulnerability?
The vulnerability ID for this Apache Log4j hotpatch package vulnerability is CVE-2021-3100.
What is the severity of the Apache Log4j hotpatch package vulnerability (CVE-2021-3100)?
The severity of the Apache Log4j hotpatch package vulnerability (CVE-2021-3100) is high with a CVSS score of 8.8.
What is the description of the Apache Log4j hotpatch package vulnerability (CVE-2021-3100)?
The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.
What software is affected by the Apache Log4j hotpatch package vulnerability (CVE-2021-3100)?
The Apache Log4j hotpatch package (log4j-cve-2021-44228-hotpatch-1.1-13) is affected by this vulnerability.
How can I fix the Apache Log4j hotpatch package vulnerability (CVE-2021-3100)?
To fix the Apache Log4j hotpatch package vulnerability (CVE-2021-3100), update to a version that addresses the issue, such as log4j-cve-2021-44228-hotpatch-1.1-13 or later.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/author
- agent/references
- agent/title
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/amazon
- canonical/amazon log4jhotpatch
- vendor/linux
- canonical/linux linux kernel