Description

AWS CloudFormation has updated cloudformation-cli-java-plugin to mitigate published security issues in Log4j2.

How to determine if you are impacted?

Go to your project’s pom.xml file and look for the cloudformation-cli-java-plugin dependency and check if the version is less than the recommended version 2.0.10.

Remediation

• Upgrade projects to use version 2.0.10 or higher.
• Publish any CloudFormation Registry extensions owned by you with a new version that includes this fix.

References

• https://logging.apache.org/log4j/2.x/security.html
• https://nvd.nist.gov/vuln/detail/CVE-2021-44228
• https://nvd.nist.gov/vuln/detail/CVE-2021-45046
• https://nvd.nist.gov/vuln/detail/CVE-2021-45105