Security Bulletin: A vulnerability in Apache Log4j (CVE-2021-45046) impacts IBM® QRadar User Behavior Analytics add on to IBM® QRadar SIEM.

Summary

There is a vulnerability in Apache Log4j which is used by IBM® QRadar User Behavior Analytics(UBA) to log system events.

Vulnerability Details

CVEID:CVE-2021-45046
**DESCRIPTION:**Apache Log4j could result in remote code execution, caused by an incomplete fix of CVE-2021-44228 in certain non-default configurations. When the logging configuration uses a non-default Pattern Layout with a Context Lookup, an attacker with control over Thread Context Map (MDC) input data can craft malicious input data using a JNDI Lookup pattern to leak sensitive information and remote code execution in some environments and local code execution in all environments.
CVSS Base score: 9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215195 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading IBM® QRadar User Behavior Analytics add on to IBM® QRadar SIEM to version 4.1.5

Updated in version 4.1.5

Note: An issue was found impacting some upgrades from earlier versions of UBA to versions 4.1.3 and 4.1.4. UBA version 4.1.5 has been released to address these upgrade issues. More information can be found in the following technote: https://www.ibm.com/support/pages/node/6527260

Workarounds and Mitigations

None