Security Bulletin: Apache Log4j vulnerabilities (CVE-2021-45105, CVE-2021-44832) in IBM WebSphere Application Server impact IBM Engineering Lifecycle Management (ELM) products based on IBM Jazz technology

Summary There are multiple vulnerabilities from Apache Log4j CVE-2021-45105, CVE-2021-44832 that affect IBM WebSphere Application Server that affect IBM Engineering Products based on IBM Jazz technology. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: IBM PowerVM Novalink is vulnerable to allow a remote attacker with permission to modify the logging configuration file to execute arbitrary code on the system due to Apache Log4j (CVE-2021-44832)

Summary IBM PowerVM Novalink, which consumes Apache Log4j, is subject to CVE-2021-44832, which allow a remote attacker with permission to modify the logging configuration file to execute arbitrary code on the system. By constructing a malicious configuration using a JDBC Appender with a data sour...

Ubuntu: Security Advisory (USN-5222-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities

Summary The IBM Planning Analytics Workspace component of IBM Planning Analytics is affected by security vulnerabilities. These have been addressed in IBM Planning Analytics 2.0 - IBM Planning Analytics Workspace 2.0.72. Vulnerability Details CVEID: CVE-2021-21366 DESCRIPTION: Node.js xmldom modu...

USN-5222-1: Apache Log4j 2 vulnerabilities

It was discovered that Apache Log4j 2 was vulnerable to remote code execution RCE attack when configured to use a JDBC Appender with a JNDI LDAP data source URI. A remote attacker could possibly use this issue to cause a crash, leading to a denial of service. CVE-2021-44832 Hideki Okamoto and Guy...

Security Bulletin: Vulnerabilitiy in Apache Log4jaffects IBM Observability with Instana - Server and Agents (CVE-2021-44228)

Summary Vulnerabilities detected in Apache Log4j versions before v2.16.0 affects IBM Observability with Instana. These have been addressed in both the Server and Agent components. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could allow a remote attacker to execute...

Security Bulletin: A Remote Attack Vulnerability in Apache Log4j affects Engineering Lifecycle Management and IBM Engineering products

Summary There is a high risk Remote Attack Vulnerability in Apache Log4j CVE-2021-44228 which is used by IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications: Engineering Lifecycle Management ELM, IBM Engineering Workflow Management EWM, IBM Engineering Systems...

Security Bulletin: Vulnerabilities in Apache Log4j affect IBM App Connect for Manufacturing 2.0 (CVE-2021-44832)

Summary Vulnerabilities in Apache Log4j affect IBM App Connect for Manufacturing 2.0. An attacker who can control log messages or log message parameters can execute arbitrary code leading to Remote Code Execution RCE attacks. IBM App Connect for Manufacturing 2.0 has addressed the vulnerability...

Security Bulletin: IBM WebSphere Hybrid Edition is vulnerable to denial of service and arbitrary code execution due to Apache Log4j (CVE-2021-45105 and CVE-2021-44832)

Summary Multiple vulnerabilities in Apache Log4j affect IBM WebSphere Application Server which is bundled with IBM WebSphere Hybrid Edition CVE-2021-45105 and CVE-2021-44832. The fix addresses the vulnerabilities by removing Apache Log4j. Vulnerability Details Refer to the security bulletins list...

Security Bulletin: IBM Tivoli Federated Identity Manager is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-4104,  CVE-2021-45046)

Summary IBM WebSphere Application Server is shipped with IBM Tivoli Federated Identity Manager. Information about security vulnerabilities CVE-2021-4104, CVE-2021-45046 affecting IBM WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the securi...

Security Bulletin: IBM TRIRIGA Connector for Esri ArcGIS Indoors is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

Summary IBM TRIRIGA Connector for Esri ArcGIS Indoors is affected by an Apache Log4j security vulnerability CVE-2021-44228. Apache Log4j is used by IBM TRIRIGA Connector for Esri ArcGIS Indoors as part of its logging infrastructure. This bulletin addresses this vulnerability by upgrading to Apach...

Security Bulletin: IBM WebSphere Service Registry and Repository is vulnerable to denial of service due to Apache Log4j (CVE-2021-45105) and arbitrary code execution (CVE-2021-4104, CVE-2021-45046 and CVE-2021-44832)

Summary IBM WebSphere Application Server, which is included as a component of IBM WebSphere Service Registry and Repository, is vulnerable to the Apache Log4j vulnerabilities. Remediation information about the security vulnerabilities has been published in a security bulletin. The fix addresses t...

Security Bulletin: Apache Log4j vulnerabilities impact IBM Tivoli System Automation Application Manager (CVE-2021-4104)

Summary There are multiple vulnerabilities identified within the Apache Log4j library used by a component of IBM Tivoli System Automation Application Manager. The fix includes Apache Log4j 2.17.0. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affect...

Security Bulletin: Multiple vulnerabilities in Apache Log4j impact IBM Workload Scheduler (CVE-2021-4104, CVE-2021-45046)

Summary This bulletin provides information for addressing the Apache Log4j vulnerabilities CVE-2021-4104, CVE-2021-45046 in IBM Workload Scheduler by remediating the vulnerabilities in IBM WebSphere Application Server WAS and IBM WebSphere Application Server Liberty. Vulnerability Details Refer t...

Security Bulletin: WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities in Apache log4j (CVE-2021-4104, CVE-2021-45046)

Summary Multiple vulnerabilities in Apache log4j affect the IBM WebSphere Application Server and IBM WebSphere Application Server Liberty CVE-2021-4104, CVE-2021-45046 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: Multiple vulnerabilities in Apache log4j affect IBM Tivoli System Automation Application Manager (CVE-2021-45105, CVE-2021-44832)

Summary There is a vulnerability in the Apache log4j library used by components of IBM Tivoli System Automation Application Manager. These have been addressed. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected...

Security Bulletin: IBM Jazz for Service Management is vulnerable to a Apache Log4j vulnerability(CVE-2021-44228)

Summary Based on current information and analysis, IBM Jazz for Service Management does not use Apache log4j-core library which is vulnerable to CVE-2021-44228. However, IBM Jazz for Service Management may be impacted because the old version of Log4j-1.2-api and Log4j-api are used in the...

Security Bulletin: IBM Jazz for Service Management is vulnerable to a Apache Log4j vulnerability (CVE-2021-44832)

Summary Based on current information and analysis, IBM Jazz for Service Management does not use Apache log4j-core library which is vulnerable to CVE-2021-44832. However, IBM Jazz for Service Management may be impacted because the old version of Log4j-1.2-api and Log4j-api are used in the...

Apache Log4j 2.x < 2.3.2, 2.4.x < 2.12.4, 2.13.x < 2.17.1 RCE Vulnerability (Dec 2021) - Windows

Apache Log4j is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:log4j"...

PT-2022-1770

Name of the Vulnerable Software and Affected Versions Apache Log4j versions 1.2.x Apache Log4j affected versions not specified Description The issue is related to the restoration of untrusted data in memory, which can allow a remote attacker to execute arbitrary code. It is also identified as a...