Security Bulletin: A vulnerability in Apache Log4j affects IBM Tivoli Netcool Impact (CVE-2021-44832)

Summary

A security vulnerability has been identified in the Apache Log4j library that could allow a remote attacker to execute arbitrary code on the system. The Log4j library is used by IBM Tivoli Netcool Impact to provide logging functionality. This vulnerability has been addressed.

Vulnerability Details

CVEID:CVE-2021-44832
**DESCRIPTION:**Apache Log4j could allow a remote attacker with permission to modify the logging configuration file to execute arbitrary code on the system. By constructing a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI , an attacker could exploit this vulnerability to execute remote code.
CVSS Base score: 6.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/216189 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

Workarounds and Mitigations

The default log4j configuration for IBM Tivoli Netcool Impact does not use a JDBC Appender. If the configuration has been changed to load a JDBC Appender, IBM recommends removing it.