CVE-2021-3100: Log4j hot patch package privilege escalation
The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Apache Log4j hotpatch package vulnerability?
The vulnerability ID for this Apache Log4j hotpatch package vulnerability is CVE-2021-3100.
What is the severity of the Apache Log4j hotpatch package vulnerability (CVE-2021-3100)?
The severity of the Apache Log4j hotpatch package vulnerability (CVE-2021-3100) is high with a CVSS score of 8.8.
What is the description of the Apache Log4j hotpatch package vulnerability (CVE-2021-3100)?
The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.
What software is affected by the Apache Log4j hotpatch package vulnerability (CVE-2021-3100)?
The Apache Log4j hotpatch package (log4j-cve-2021-44228-hotpatch-1.1-13) is affected by this vulnerability.
How can I fix the Apache Log4j hotpatch package vulnerability (CVE-2021-3100)?
To fix the Apache Log4j hotpatch package vulnerability (CVE-2021-3100), update to a version that addresses the issue, such as log4j-cve-2021-44228-hotpatch-1.1-13 or later.