Security Bulletin: IBM Cloud Pak for Automationis vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)

Summary

Multiple Apache Log4j vulnerabilities (CVE-2021-45105, CVE-2021-45046) have been reported for the log4j-core-2.x library, which is packaged in several components of IBM Cloud Pak for Automation. This fix upgrades all copies of log4j-core-2.x to 2.17.0.

Vulnerability Details

CVEID:CVE-2021-45105
**DESCRIPTION:**Apache Log4j is vulnerable to a denial of service, caused by the failure to protect from uncontrolled recursion from self-referential lookups. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input data that contains a recursive lookup to cause a StackOverflowError that will terminate the process. Note: The vulnerability is also called LOG4J2-3230.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215647 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2021-45046
**DESCRIPTION:**Apache Log4j could result in remote code execution, caused by an incomplete fix of CVE-2021-44228 in certain non-default configurations. When the logging configuration uses a non-default Pattern Layout with a Context Lookup, an attacker with control over Thread Context Map (MDC) input data can craft malicious input data using a JNDI Lookup pattern to leak sensitive information and remote code execution in some environments and local code execution in all environments.
CVSS Base score: 9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215195 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

V18.0.0 - V18.0.2
V19.0.1 - V19.0.3
V20.0.1 - V20.0.3-IF011
V21.0.1 - V21.0.1-IF007
V21.0.2 - V21.0.2-IF006
V21.0.3 - V21.0.3-IF001

Remediation/Fixes

The recommended action is to upgrade to the latest cumulative security fix for your release and consider upgrading to the latest release.

• IBM Cloud Pak for Automation 20.0.3-IF012
• IBM Cloud Pak for Automation 21.0.2-IF007
• IBM Cloud Pak for Automation 21.0.3-IF002
  Affected Product(s)|Version(s)|Remediation / Fix
  —|—|—
  IBM Cloud Pak for Automation| V18.0.0 - V20.0.2|

Upgrade to V21.0.3 and apply IBM Cloud Pak for Automation 21.0.3-IF002 or later

IBM Cloud Pak for Automation| V20.0.3 - V20.0.3-IF011|

Apply IBM Cloud Pak for Automation 20.0.3-IF012 or
Upgrade to V21.0.3 and apply IBM Cloud Pak for Automation 21.0.3-IF002 or later

IBM Cloud Pak for Automation

| V21.0.2 - V21.0.2-IF006| Apply IBM Cloud Pak for Automation 21.0.2-IF007 or
Upgrade to V21.0.3 and apply IBM Cloud Pak for Automation 21.0.3-IF002 or later

IBM Cloud Pak for Automation

| V21.0.3 - V21.03-IF001|

Apply IBM Cloud Pak for Automation 21.0.3-IF002

Workarounds and Mitigations

None