Risk | High |
Patch available | YES |
Number of vulnerabilities | 3 |
CVE-ID | CVE-2022-23302 CVE-2022-23305 CVE-2022-23307 CVE-2020-9493 |
CWE-ID | CWE-502 CWE-89 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Amazon Linux AMI Operating systems & Components / Operating system log4j Operating systems & Components / Operating system package or component |
Vendor | Amazon Web Services |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
EUVDB-ID: #VU59692
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23302
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data in JMSSink. A remote attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests and execute arbitrary code on the target system.
Note, a non-default configuration with support for JMSSink is required to exploit this vulnerability.
Update the affected packages:
noarch:Vulnerable software versions
log4j-1.2.17-16.14.amzn1.noarch
log4j-javadoc-1.2.17-16.14.amzn1.noarch
log4j-manual-1.2.17-16.14.amzn1.noarch
src:
log4j-1.2.17-16.14.amzn1.src
Amazon Linux AMI: All versions
log4j: before 1.2.17-16.14
CPE2.3 External linkshttp://alas.aws.amazon.com/ALAS-2023-1718.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU59691
Risk: Medium
CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23305
CWE-ID:
CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in the JDBCAppender. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Note, a non-default configuration with enabled JDBCAppender is required to exploit the vulnerability.
Update the affected packages:
noarch:Vulnerable software versions
log4j-1.2.17-16.14.amzn1.noarch
log4j-javadoc-1.2.17-16.14.amzn1.noarch
log4j-manual-1.2.17-16.14.amzn1.noarch
src:
log4j-1.2.17-16.14.amzn1.src
Amazon Linux AMI: All versions
log4j: before 1.2.17-16.14
CPE2.3 External linkshttp://alas.aws.amazon.com/ALAS-2023-1718.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU59693
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-23307,CVE-2020-9493
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected packages:
noarch:Vulnerable software versions
log4j-1.2.17-16.14.amzn1.noarch
log4j-javadoc-1.2.17-16.14.amzn1.noarch
log4j-manual-1.2.17-16.14.amzn1.noarch
src:
log4j-1.2.17-16.14.amzn1.src
Amazon Linux AMI: All versions
log4j: before 1.2.17-16.14
CPE2.3 External linkshttp://alas.aws.amazon.com/ALAS-2023-1718.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.