CVE-2022-0070: Log4j hot patch package privilege escalation

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-19 · updated 2026-06-17
Weakness: CWE-250

Description

Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 will now explicitly mimic the Linux capabilities and cgroups of the target Java process that the hotpatch is applied to.

Affected products

Amazon Log4Jhotpatch: before 1.1-16 — fixed in 1.1-16

How to fix

Upgrade to a fixed version: Amazon Log4Jhotpatch 1.1-16. Check the vendor advisory for mitigations.

References

https://alas.aws.amazon.com/cve/html/CVE-2022-0070.html
https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities
https://alas.aws.amazon.com/cve/html/CVE-2022-0070.html
https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities

Get alerted when CVE-2022-0070 or the next vulnerability affects your stack