Security Bulletin: Multiple vulnerabilities in Apache Log4j impact IBM Workload Scheduler (CVE-2021-4104, CVE-2021-45046)

Summary

This bulletin provides information for addressing the Apache Log4j vulnerabilities (CVE-2021-4104, CVE-2021-45046) in IBM Workload Scheduler by remediating the vulnerabilities in IBM WebSphere Application Server (WAS) and IBM WebSphere Application Server Liberty.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

**IBM strongly recommends addressing the vulnerability now. **

Refer to the following security bulletin for vulnerability details and information about fixes addressed by IBM WebSphere Application Server and IBM WebSphere Application Server Liberty which are shipped with IBM Workload Scheduler.

<https://www.ibm.com/support/pages/node/6526750&gt;

• Implementing the Remediation/Fixes detailed in the WAS bulletin addresses the vulnerabilities for the IBM Workload Scheduler versions listed in the Affected Products/Versions section. Note that IWS 9.5 Liberty is not configured with features zosConnect-1.0 and zosConnect-1.2 so it is not affected.

Workarounds and Mitigations

None