Security Bulletin: IBM WebSphere Service Registry and Repository is vulnerable to denial of service due to Apache Log4j (CVE-2021-45105) and arbitrary code execution (CVE-2021-4104, CVE-2021-45046 and CVE-2021-44832)

Summary

IBM WebSphere Application Server, which is included as a component of IBM WebSphere Service Registry and Repository, is vulnerable to the Apache Log4j vulnerabilities. Remediation information about the security vulnerabilities has been published in a security bulletin. The fix addresses the vulnerabilities by removing Apache Log4j.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerabilities now.

For WebSphere Service Registry and Repository V8.0, refer to information and steps in:

• Security Bulletin: Multiple vulnerabilities in Apache log4j affect the IBM WebSphere Application Server and IBM WebSphere Application Server Liberty (CVE-2021-4104, CVE-2021-45046)

For WebSphere Service Registry and Repository V8.5, review either the bulletin referenced for V8.0 or:

• Security Bulletin: Multiple vulnerabilities in Apache log4j affect IBM WebSphere Application Server (CVE-2021-45105, CVE-2021-44832)

and take applicable action.

Workarounds and Mitigations

None