Kinesis agent using log4j -zero day vulnerable version

Thanks. Anyone has an idea when the update will be pushed to Amazon Linux 2 repo?

Version 2.17.1 of log4j is included in the installation of the latest Kinesis Agent on AL2

To verify:

1. Start an AL2 EC2 instance, then connect to it - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-prerequisites.html#eic-prereqs-network-access
2. Install git

 sudo yum install git

3. Download the latest Kinesis Agent project from Github

git clone https://github.com/awslabs/amazon-kinesis-agent.git

4. Install agent

sudo ./setup --install

Observe log4j-1.2-api-2.17.1.jar is installed. You can also verify by viewing the installation manifest in the pom.xml file at the root of the github project directory.