Direct links to fixes
APAR status
Closed as program error.
Error description
Multiple vulnerabilities have been reported for log4j-1.x. These vulnerabilities have been assessed as not applicable in the context of IBM Business Automation Workflow, IBM Business Process Manager and Desktop Process Designer. The Apache foundation stopped supporting log4j-1.x several years ago. There is a latent risk of new vulnerabilities being reported for log4j-1.x and no expectation of fixes by the Open Source community. As a matter of precaution, log4j-1.x is removed or upgraded where possible. CVEID: CVE-2021-4104 DESCRIPTION: Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data when the attacker has write access to the Log4j configuration. If the deployed application is configured to use JMSAppender, an attacker could exploit this vulnerability to execute arbitrary code on the system. CVSS Base score: 8.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215048 for the current score. PRODUCTS AFFECTED IBM Business Automation Workflow IBM Business Process Manager (BPM) Advanced IBM BPM Standard IBM BPM Express
Local fix
Problem summary
No additional information is available.
Problem conclusion
A fix that removes copies of log4j-1.x. from the shared library <INSTALL_ROOT>/BPM/Lombardi/lib in IBM Business Automation Workflow, IBM Business Process Manager and the teamworks\eclipse\plugins, ilog\eclipse\plugins directory in IBM Process Designer is available for the latest fix pack for IBM BPM V8.5.7, IBM BPM V8.6, Business Automation Workflow 19.0.0.3, 20.0.0.2, 21.0.2, 21.0.3, and is planned for inclusion in a future release of Business Automation Workflow. log4j.jar is removed from the following folders: - WAS_INSTALL_ROOT/BPM/Lombardi/lib - PD_INSTALL_ROOT/teamworks/eclipse/plugins/teamworks.appserver.we bsphere_8.5.7.0/lib - PD_INSTALL_ROOT/ilog/eclipse/plugins/com.ibm.rules.thirdparty.lo g4j_8.8.1.201811211258/lib
Temporary fix
Comments
APAR Information
APAR number
JR64655
Reported component name
BUS AUTO WORKFL
Reported component ID
5737H4100
Reported release
K00
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2022-03-14
Closed date
2022-04-15
Last modified date
2022-04-15
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
BUS AUTO WORKFL
Fixed component ID
5737H4100
Applicable component levels
[{"Line of Business":{"code":"LOB45","label":"Automation"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS8JB4","label":"IBM Business Automation Workflow"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"20.0.0.1"}]
Document Information
Modified date:
16 April 2022