IT39393: SECURITY APAR FOR CVE-2021-44228

IBM Spectrum Control 5.4.5.1 (December 2021)
IBM Spectrum Control 5.4.5.2 (December 2021)

APAR status

• Closed as program error.

Error description

• ADV0040111 - Global threat CVE: Log4j - CVE-2021-44228 (Publicly
  disclosed vulnerability)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Control 5.4.x and IBM Storage Insights users    *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * A vulnerability in Apache Log4j could allow                  *
  * an attacker to execute arbitrary code on the                 *
  * system. This vulnerability may affect IBM                    *
  * Spectrum Control due to its use of Log4j for                 *
  * logging, tracing, alerting, and the local help               *
  * documentation.                                               *
  *                                                              *
  * See security bulletin for details of the vulnerability:      *
  * https://www.ibm.com/support/pages/node/6527086               *
  *                                                              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Spectrum Control users, apply fix maintenance                *
  * when available.                                              *
  ****************************************************************
  

Problem conclusion

• See security bulletin for details:
  https://www.ibm.com/support/pages/node/6527086
  
  
  The fix for this APAR is contained in the following releases:
  
  IBM Storage Insights 4Q21   [ 54X-IBM-SI ]
  
  IBM Spectrum Control 5.4.5.1  [ 5.4.5-IBM-SC-FP0001 ]
  https://www.ibm.com/support/pages/node/359939
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• LOG4J
  

Fix information

• Fixed component name

  TPC

• Fixed component ID

  5608TPC00

Applicable component levels