Security Bulletin: Vulnerability in Apache Log4j (CVE-2021-44228) affects IBM Spectrum Fusion HCI which includes IBM Spectrum Scale Container Native Storage Access and IBM Spectrum Protect Plus

Summary

A vulnerability in Apache Log4j could allow an attacker to execute arbitrary code on the system. This vulnerability may affect IBM Spectrum Scale Container Native Storage Access and IBM Spectrum Protect Plus, which are part of the IBM Spectrum Fusion appliance.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

The IBM Spectrum Fusion HCI 2.1 appliance includes IBM Spectrum Scale Container Native Storage Access (CNSA) 5.1.1.3 and IBM Spectrum Protect Plus 10.1.8.1, which are impacted by the Apache Log4j (CVE-2021-44228).

• IBM Spectrum Scale CNSA lists a range of versions “Customers running IBM Spectrum Scale CNSA V5.1.1.1 through V5.1.2.1.” but only version 5.1.1.3 is supported by IBM Spectrum Fusion HCI 2.1.
• IBM Spectrum Protect Plus lists a range of versions “10.1.0.0 - 10.1.9.0”, but only version 10.1.8.1 is supported by IBM Spectrum Fusion HCI 2.1.

Refer the security bulletin links under Workarounds and Mitigationssection.

Note: The IBM Spectrum Fusion HCI 2.1 management GUI is not impacted by CVE-2021-44228.

Remediation/Fixes

Refer to the instructions in the Workarounds and Mitigations section.

-–>>> UPDATE 16 January 2022 <<<-–

The fix for vulnerability CVE-2021-44228 is in IBM Spectrum Fusion HCI version 2.1.2

See the following page for upgrade instructions:

_<https://www.ibm.com/support/pages/node/6488389&gt;_

Upgrading to IBM Spectrum Fusion HCI version 2.1.2 will automatically pick up and upgrade the embedded components IBM Spectrum Scale and IBM Spectrum Protect plus to remediate the log4j vulnerabilities (CVE-2021-44228, CVE-2021-45105, and CVE-2021-45046) in those components respectively.

If you upgrade to IBM Spectrum Fusion HCI v2.1.2, then you do not need to follow the workarounds specified in the Workarounds and Mitigations section below.

If you have already followed the workarounds below for CVE-2021-4428, then you will still need to upgrade to IBM Spectrum Fusion v2.1.2 to remediate CVE-2021-45105, CVE-2021-45046.

Workarounds and Mitigations

(Update: 16 January 2022: See “Update” in Remediation/Fixes section above for new instructions.)

IBM strongly recommends addressing the vulnerability now by executing these steps:

• Refer to the following security bulletin for remediation and additional vulnerability details for IBM Spectrum Scale Container Native Storage Access (CNSA) 5.1.1.3:
  <https://www.ibm.com/support/pages/node/6526202&gt;

IBM Spectrum Scale CNSA lists a range of versions “Customers running IBM Spectrum Scale CNSA V5.1.1.1 through V5.1.2.1.” but only version 5.1.1.3 is supported by IBM Spectrum Fusion HCI 2.1.

• Refer to the following security bulletin for remediation and additional vulnerability details for IBM Spectrum Protect Plus 10.1.8.1:
  <https://www.ibm.com/support/pages/node/6527828&gt;

IBM Spectrum Protect Plus lists a range of versions “10.1.0.0 - 10.1.9.0”, but only version 10.1.8.1 is supported by IBM Spectrum Fusion HCI 2.1.