Security Bulletin: Vulnerability in Apache Log4j may affect IBM Spectrum Protect Snapshot on Windows (CVE-2021-44832)

Summary

A vulnerability in Apache Log4j could result in remote code execution. IBM Spectrum Protect Snapshot on Windows includes the IBM Spectrum Protect Backup-Archive Cliient which installs the vulnerable Log4j files. Based on current information and analysis, Log4j is not used by IBM Spectrum Protect Snapshot on Wiindows. The below fix package includes Apache Log4j 2.17.1.

Vulnerability Details

CVEID:CVE-2021-44832
**DESCRIPTION:**Apache Log4j could allow a remote attacker with permission to modify the logging configuration file to execute arbitrary code on the system. By constructing a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI , an attacker could exploit this vulnerability to execute remote code.
CVSS Base score: 6.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/216189 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

4.1.6.10-4.1.6.x

Note: IBM Spectrum Protect Snapshot for Windows packages the IBM Spectrum Protect Backup-Archive client which installs the affected Log4j files but these files are not used.

Remediation/Fixes

IBM strongly recommends addressing this vulnerability now by upgrading.

Note: The below fix packages include Log4j 2.17.1.

IBM Spectrum Protect Snapshot for Windows Affected Versions|Fixing Level|Platform|**Link to Fix and Instructions
**
—|—|—|—
8.1.11.0-8.1.13.2| 8.1.13.3| Windows| <https://www.ibm.com/support/pages/node/6540262&gt;
4.1.6.10-4.1.6.x| Client Fixing Level is 7.1.8.15| Windows|

Apply the IBM Spectrum Protect Client 7.1.8.15 fix using this link
<https://www.ibm.com/support/pages/node/316619&gt;

Workarounds and Mitigations

None