Security Bulletin: Vulnerability in Apache Log4j (CVE-2021-44228) impacts IBM Watson Machine Learning Accelerator

Summary

Log4j is used by IBM Watson Machine Learning Accelerator for generating logs in some of its components. This bulletin provides mitigations for the Log4j vulnerability (CVE-2021-44228) by applying workaround steps to IBM Watson Machine Learning Accelerator.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Remediation/Fixes

Patch will be released once available.

Workarounds and Mitigations

If unable to upgrade to the latest version 2.3.4, IBM strongly recommends mitigating the vulnerability in version 1.2.x now by executing the workaround and mitigation steps as outlined below.

Environment:
Linux x86_64, ppc64le

Workaround and mitigation steps:

Note: For IBM Watson Machine Learning Accelerator version 1.2.1, you must install the Interim fix 536919.
Refer to the details documented here: <https://www.ibm.com/docs/en/wmla/1.2.1?topic=accelerator-interim-fixes&gt;

1. Apply the fix of “Vulnerability in Apache Log4j addressed in IBM Spectrum Conductor” by following the security bulletin: <https://www.ibm.com/support/pages/node/6526754&gt;

2. Log on to the primary host as the cluster administrator, stop dlpd service
> source installation_top/profile.platform
> egosh user logon -u Admin -x Admin_password
> egosh service stop dlpd

3. Log on to each management host and remove the following class from the jar files
For IBM Watson Machine Learning Accelerator version 1.2.1:
zip -q -d $EGO_TOP/dli/1.2.3/dlpd/lib/log4j-core-2.7.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

For IBM Watson Machine Learning Accelerator version 1.2.2:
zip -q -d $EGO_TOP/dli/1.2.4/dlpd/lib/log4j-core-2.7.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

For IBM Watson Machine Learning Accelerator version 1.2.3:
zip -q -d $EGO_TOP/dli/1.2.5/dlpd/lib/log4j-core-2.7.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

4. Log on to the primary host as the cluster administrator and start dlpd service

> source installation_top/profile.platform
> egosh user logon -u Admin -x Admin_password
> egosh service start dlpd