Security Bulletin: A Remote Attack Vulnerability in Apache Log4j affects IBM Engineering Lifecycle Optimization - Integration Adapters Tasktop Edition and Tasktop Sync

Summary

No action is required for Tasktop Viz or Tasktop Sync or IBM Engineering Lifecycle Optimization - Integration Adapters Tasktop Edition as they were not impacted by this vulnerability. Sync or IBM LIA is using Log4J 1.2.15, which is very old and not subject to the Log4J vulnerability. The vulnerability was found in 2.15, but Sync is using 1.2.15

Vulnerability Details

CVEID:CVE-2021-44228
**DESCRIPTION:**Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against attacker controlled LDAP and other JNDI related endpoints by JNDI features. By sending a specially crafted code string, an attacker could exploit this vulnerability to load arbitrary Java code on the server and take complete control of the system. Note: The vulnerability is also called Log4Shell or LogJam.
CVSS Base score: 10
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/214921 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

None

Remediation/Fixes

None

Workarounds and Mitigations

None