Security Bulletin: The Apache Log4j (CVE-2021-4104) vulnerability affects TPF Operations Server

2022-04-2115:51:54

www.ibm.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

0.127 Low

EPSS

Percentile

95.4%

JSON

Summary

The Apache Log4j vulnerability (CVE-2021-4104) affects the TPF Operations Server, which runs with the z/Transaction Processing Facility (z/TPF). The TPF Operations Server uses Apache Log4j as part of its logging infrastructure. All components in the TPF Operations Server that use Apache Log4j have been updated to use Apache Log4j 2.17.1.

Vulnerability Details

CVEID:CVE-2021-4104
**DESCRIPTION:**Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data when the attacker has write access to the Log4j configuration. If the deployed application is configured to use JMSAppender, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 8.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215048 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
TPF Operations Server	1.2.06

Remediation/Fixes

Product	VRMF	APAR	Remediation/First Fix
TPF Operations Server	1.2.06	IT40013	Apply the APAR, which is available for download from the TPF Product Family: Maintenance for TPF Operations Server web page.