Security Bulletin: Apache Log4j vulnerability affects IBM Cloud Pak for Automation (CVE-2021-44228)

Summary A remote code execution vulnerability has been reported for log4j-core-2.x libraries, which are used in various components of IBM Cloud Pak for Business Automation. Vulnerability Details CVEID:CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code...

Security Bulletin: Rational Test Automation Server is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

Summary Apache Log4j vulnerability associated with the Rational Performance Tester Apache JMeter™ Test Extension impacts Rational Test Automation Server. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system,...

Security Bulletin: IBM Security Access Manager for Enterprise Single Sign-On is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)

Summary Apache Log4j is used by IBM Security Access Manager for Enterprise Single Sign-On as part of its logging infrastructure. IBM Security Access Manager for Enterprise Single Sign-On is vulnerable to denial of service and arbitrary code execution due to Apache Log4j CVE-2021-45105 and...

Security Bulletin: IBM Telco Network Cloud Manager - Performance is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)

Summary Apache Log4j is used by IBM Telco Network Cloud Manager - Performance for logging and is vulnerable to denial of service and arbitrary code execution due to Apache Log4j CVE-2021-45105 and CVE-2021-45046. The fix includes Apache Log4j v2.17. Vulnerability Details CVEID: CVE-2021-45105...

Security Bulletin: IBM QMF Analytics for Multiplatforms is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

Summary Apache Log4j is used by the QMF Vision component of IBM QMF Analytics for Multiplatforms as part of its logging infrastructure and is vulnerable to arbitrary code execution CVE-2021-44228. The fix includes Apache Log4j v2.17.0. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apac...

Security Bulletin: Cloud Pak for Security is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)

Summary Cloud Pak for Security CP4S is vulnerable to denial of service and arbitrary code execution CVE-2021-45105, CVE-2021-45046, through the use of Apache Log4j's JNDI logging feature in CP4S Risk Manager component and SOAR component using Elastic Search. The vulnerabilities have been addresse...

Security Bulletin: Crypto Hardware Initialization and Maintenance is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105, CVE-2021-45046)

Summary Crypto Hardware Initialization and Maintenance CHIM 3.0.0 as shipped with CCA 7.2.55 for MTM 4769 is affected by several vulnerabilities in Apache Log4j CVE-2021-45105 and CVE-2021-45046. CHIM is using Apache Log4j for internal logging purposes of regular user activity. The fix includes...

Security Bulletin: Vulnerability in Apache Log4j affects WebSphere Application Server (CVE-2021-44228) bundled with Predictive Maintenance and Quality and Predictive Maintenance Insights

Summary IBM WebSphere Application Server is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. Vulnerabilities have been identified in Apache Log4j which affect WebSphere Application Server CVE-2021-44228. The recommended solution is to manually...

Security Bulletin: IBM Db2® Warehouse is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-45046)

Summary Apache Log4j open source library used by IBM® Db2® Warehouse is affected by multiple vulnerabilitiies CVE-2021-45105 and CVE-2021-45046. This library is used by the Db2 Federation, Spark, Livy and IBM Spectrum Protect as part of its logging infrastructure. The fix includes includes Apache...

CVE-2021-44530

An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier Log4J CVE-2021-44228 allows a malicious actor to control the application...

Sql injection

An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier Log4J CVE-2021-44228 allows a malicious actor to control the application...

CVE-2021-44530

Technical details for CVE-2021-44530 are not provided in the connected documents. The available sources only reaffirm a Log4j-related vulnerability in UniFi prior to 6.5.53. Monitor for updates from vendors.

CVE-2021-44530

An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier Log4J CVE-2021-44228 allows a malicious actor to control the application...

Metasploit Weekly Wrap-Up

Log4Shell goodness Log4Shell made an unfortunate end to 2021 for many organizations, but it also makes for some great additions to Metasploit Framework. Contributors sempervictus, schierlm, righel, timwr and our very own Spencer McIntyre have collaborated to bring us a Log4Shell module that uses...

Security Bulletin: IBM Rational Build Forge is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228).

Summary IBM Rational Build Forge is vulnerable to CVE-2021-44228 as the jas.war is built upon Java-1.8 and leverages Apache Log4j 2.6.1 jar file. The fix includes Apache Log4j 2.17.1. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute...

Security Bulletin: Vulnerability in Apache Log4j may affect IBM Spectrum Protect Operations Center (CVE-2021-44832)

Summary A vulnerability in Apache Log4j could result in remote code execution. This vulnerability may affect the Help system in IBM Spectrum Protect Operations Center. The below fix packages include Apache Log4j 2.17.1. Vulnerability Details CVEID: CVE-2021-44832 DESCRIPTION: Apache Log4j could...

Security Bulletin: Vulnerability in Apache Log4j affects IBM Db2® Warehouse (CVE-2021-44228)

Summary Apache Log4j open source library used by IBM® Db2® Warehouse is affected by a vulnerability that could allow a remote attacker to execute arbitrary code on the system. This library is used by the Db2 Federation feature. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j...

Security Bulletin: Vulnerability in Apache Log4j may affect IBM Spectrum Protect for Space Management (CVE-2021-44832)

Summary A vulnerability in Apache Log4j could result in remote code execution. IBM Spectrum Protect for Space Management includes the IBM Spectrum Protect Backup-Archive Client which installs the vulnerable Log4j files. The below fix packages include Apache Log4j 2.17.1. Vulnerability Details...

Security Bulletin: Vulnerability in Apache Log4j impacts IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments (CVE-2021-44832)

Summary A vulnerability in Apache Log4j could result in remote code execution. This vulnerability may impact the IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments due to their uses of Apache Log4j for logging of messages and traces. The below fix package...

Security Bulletin: Rational Test Workbench bundles Rational Performance Tester which is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

Summary Rational Test Workbench RTW bundles Rational Performance Tester RPT. The Apache Log4j vulnerability impacts RPT Apache JMeter™ Test Extension. This bulletin addresses the vulnerability by removing Apache Log4j. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could...