AWS Notes
5.6K subscribers
444 photos
42 videos
10 files
2.8K links
AWS Notes — Amazon Web Services Educational and Information Channel

Chat: https://xn--r1a.website/aws_notes_chat

Contacts: @apple_rom, https://www.linkedin.com/in/roman-siewko/
Download Telegram
​​Weekly Summary on AWS (December 12-18)

Log4j2 CVE-2021-44228 related updates

▪️ WAF + AWSManagedRulesKnownBadInputsRuleSet updated with Log4JRCE protection support
Multiple versions during this week.
• Added the rule Log4JRCE version 1.2 in response to the recently disclosed security issue within Log4j. For information see CVE-2021-44228. This rule inspects common URI paths, query strings, the first 8KB of the request body, and common headers. The rule uses double URL_DECODE_UNI text transformations.
• Released version 1.3 of Log4JRCE to tune the matching criteria and to inspect additional headers.
• Released version 1.4 of the rule Log4JRCE to tune the matching criteria and to inspect additional headers.
• Released version 1.5 to tune the matching criteria. 
• Released version 1.8 of the rule Log4JRCE to improve header inspection and matching criteria. 

▪️ IoT Greengrass Core
1.11.5 — to fix Log4j for 1.11.x versions
1.10.5 — to fix Log4j for 1.10.x versions

▪️ IoT SiteWise
• OPC-UA collector 2.0.3 with Log4j fix
• Data processing pack 2.0.14 with Log4j fix
• Publisher 2.0.2 with Log4j fix

▪️ CloudHSM — CloudHSM JCE SDK version 3.4.2 — with Log4j updated to version 2.16.0.

▪️ Amazon LinuxHotpatch for Apache Log4j
yum install log4j-cve-2021-44228-hotpatch

▪️ EMRApproach to mitigate CVE-2021-44228

▪️ KinesisAmazon Kinesis Agent v2.0.4 with log4j 2.16.0

▪️ Lambdaaws-lambda-java-log4j2 library v1.4.0 with Log4j fix

▪️ NICE — EnginFrame update instruction with Log4j fix

Other updates

🔹 Amazon Detective + Organizations

🔸 New! AWS RegionJakarta, Indonesia

#AWS_week