Security Bulletin: Vulnerability in Apache Log4j affects IBM Cloud Private (CVE-2021-45046)

Summary

There is a vulnerability in the Apache Log4j open source library. The library is used by Elasticsearch, a dependency of IBM Cloud Private, for logging messages to files. This bulletin identifies the security fixes to apply to address the Log4Shell vulnerability (CVE-2021-45046).

Vulnerability Details

CVEID:CVE-2021-45046
**DESCRIPTION:**Apache Log4j could result in remote code execution, caused by an incomplete fix of CVE-2021-44228 in certain non-default configurations. When the logging configuration uses a non-default Pattern Layout with a Context Lookup, an attacker with control over Thread Context Map (MDC) input data can craft malicious input data using a JNDI Lookup pattern to leak sensitive information and remote code execution in some environments and local code execution in all environments.
CVSS Base score: 9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215195 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading.

The recommended solution involves the IBM Cloud Private ibm-icplogging component. It is recommended that you follow the instructions for the component in the links listed below:

For IBM Cloud Private 3.1.0: IBM Cloud Private 3.1.0 Patch

For IBM Cloud Private 3.1.1: IBM Cloud Private 3.1.1 Patch

For IBM Cloud Private 3.1.2: IBM Cloud Private 3.1.2 Patch

For IBM Cloud Private 3.2.0: IBM Cloud Private 3.2.0 Patch

For IBM Cloud Private 3.2.1: IBM Cloud Private 3.2.1 Patch

For IBM Cloud Private 3.2.2: IBM Cloud Private 3.2.2 Patch

For IBM Cloud Private 3.1.0:

• Upgrade to the latest Continuous Delivery (CD) update package, IBM Cloud Private 3.2.2.

Workarounds and Mitigations

None