Security Bulletin: Predictive Maintenance and Quality and Predictive Maintenance Insights is vulnerable to arbitrary code execution and denial of service due to Apache Log4j (CVE-2021-45105, CVE-2021-45046, CVE-2021-4104, CVE-2021-44832).

Summary

IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises are vulnerable to Apache Log4j (CVE-2021-45105, CVE-2021-45046, CVE-2021-4104, CVE-2021-44832) due to multiple components using Apache Log4j for logging. This has been addressed in each of the components; refer to the Remediation section for details.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerabilities now by applying interim fixes for all components as listed for all Affected Products/Versions listed above.

Affected Component

|

_Remediation/Fix _

|

**Security Bulletin and****Fix Details
**

—|—|—

Websphere Application Server 9.0

|

Apache Log4j library is removed. Upgrade to minimal fix pack levels as required by interim fix and then apply Interim Fix PH42762, or Apply Fix Pack 9.0.5.11.

|

<https://www.ibm.com/support/pages/node/6538148&gt;

(CVE-2021-45105, CVE-2021-44832)

<https://www.ibm.com/support/pages/node/6526750&gt;

(CVE-2021-4104, CVE-2021-45046)

Db2 11.5

|

Apache Log4j library is updated to 2.17.0. Apply interim fix as per <https://www.ibm.com/support/pages/apar/IT39474&gt;

|

<https://www.ibm.com/support/pages/node/6528672&gt;

(CVE-2021-45046, CVE-2021-45105)

Cognos 11.1

|

11.1.7 Interim Fix 8 includes Apache Log4j upgrade to v2.17.1.

|

<https://www.ibm.com/support/pages/node/6538720&gt;

(CVE-2021-45046)

SPSS Modeler 18.2

|

Interim Fix includes upgrading Apache Log4j to 2.17.0.

|

<https://www.ibm.com/support/pages/node/6555104&gt; (CVE-2021-4104)

SPSS Collaboration and Deployment Services 18.2

|

Interim fix includes upgrading Apache Log4J to 2.17.1.

|

<https://www.ibm.com/support/pages/node/6549774&gt; (CVE-2021-4104)

SPSS Statistics Server 26.0

|

Interim fix includes upgrading Apache Log4J to 2.17.1

|

<https://www.ibm.com/support/pages/node/6527952&gt; (CVE-2021-4104)

SPSS Analytic Server 3.1.1

|

Interim fix includes upgrading Apache Log4J to 2.17.1

|

<https://www.ibm.com/support/pages/node/6540892&gt; (CVE-2021-4104)

Workarounds and Mitigations

None