Security Bulletin: Vulnerability in Apache Log4j addressed in IBM Spectrum Symphony

Summary

Log4j is used by IBM Spectrum Symphony for generating logs in some of its components. This bulletin provides patches for the Log4Shell vulnerability (CVE-2021-44228) to IBM Spectrum Symphony.

Vulnerability Details

CVEID:CVE-2021-44228
**DESCRIPTION:**Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against attacker controlled LDAP and other JNDI related endpoints by JNDI features. By sending a specially crafted code string, an attacker could exploit this vulnerability to load arbitrary Java code on the server and take complete control of the system. Note: The vulnerability is also called Log4Shell or LogJam.
CVSS Base score: 10
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/214921 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

P104504

P104509

P104522

P104521

|

sym-7.2.0.2-build600934

sym-7.2.0.2-build600939

sym-7.2.0.2-build600941

sym-7.2.0.2-build600944

IBM Spectrum Symphony| 7.2.1/7.2.1.1|

P104505

P104510

P104524

P104523

|

sym-7.2.1-build600935

sym-7.2.1-build600940

sym-7.2.1-build600942

sym-7.2.1-build600945

IBM Spectrum Symphony| 7.3|

P104506

P104508

|

sym-7.3-build600936

sym-7.3-build600943

IBM Spectrum Symphony| 7.3.1| P104507| sym-7.3.1-build600937
IBM Spectrum Symphony| 7.3.2| P104511| sym-7.3.2-build600938

Workarounds and Mitigations

None