EMR with Log4j 2.17.1

Hi, Does EMR have a fix to resolve the issue related to log4j CVE's to upgrade to Log4J 2.17.1. Do you know when will it be available.

主題

分析

標籤

Amazon EMR

語言

English

jayaram

已提問 2 年前檢視次數 1018 次

1 個回答

最新
最多得票
最多評論

這些答案是否有幫助？支持正確答案，以幫助社區從您的知識中受益。

已接受的答案

Hi @jayaram

Yes there is a fix, you need to set up an EMR bootstrap action to run the provided script for the EMR version as described in Approach to mitigate CVE-2021-44228

Ai-Linh

已回答 2 年前

專家

Fabrizio@AWS

已審閱 2 年前

jayaram
2 年前
Can you provide details on this specific CVE : 2021-44832 This one is reffering to all the 2.x versions. Can you let me know when will the patch be available for this?
Fabrizio@AWS 專家
2 年前
@jayaram CVE : 2021-44832 should only impact Apache Log4j2 versions 2.0-beta7 through 2.17.0 and the resolution is : This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. https://nvd.nist.gov/vuln/detail/CVE-2021-44832

EMR with Log4j 2.17.1

相關內容