Security Bulletin: Vulnerability in Apache Log4j affects Cloud Pak for Security (CVE-2021-44228)

Remediation/Fixes

For Cloud Pak for Security 1.8.x and 1.9.x :

Ensure that you are logged in to the cluster by using either of the following oc login commands:
 
Using username and password:

oc login <openshift_url> -u <username> -p <password>
 
Using a token:

oc login --token=<token> --server=<openshift_url>
 
 
Check the current value of  `imagePullPolicy` using the command : 
 
oc get -n <CP4S_NAMESPACE> cp4sthreatmanagement threatmgmt -o yaml | grep imagePullPolicy:
 
If  `imagePullPolicy` is not set to "Always" :
 
oc patch -n <CP4S_NAMESPACE> cp4sthreatmanagement threatmgmt --type merge --patch '{"spec":{"extendedDeploymentConfiguration":{"imagePullPolicy":"Always"}}}'
 
Else, if the `imagePullPolicy` value is already set to "Always" :
 
oc delete pod  -lsequence=idrmapp -n <CP4S_NAMESPACE>
 
After executing either of the above commands the pods will restart which can be monitored using :
 
oc get pods -n <CP4S_NAMESPACE> -w

For Cloud Pak for Security 1.7.2.0 :

Ensure that you are logged in to the cluster by using either of the following oc login commands:
 
Using username and password:

oc login <openshift_url> -u <username> -p <password>
 

Using a token:

oc login --token=<token> --server=<openshift_url>

Select your CP4S namespace :

oc project <CP4S_NAMESPACE>

Check the current value of  `imagePullPolicy` : 

oc get iscinventory iscplatform -o yaml | grep imagePullPolicy:

If the value of `imagePullPolicy` is not set to “Always” :

oc patch iscinventory iscplatform --type merge --patch '{"spec":{"definitions":{"imagePullPolicy": "Always"}}}' && oc delete pod -lname=sequences

Else if the value of the `imagePullPolicy` is already set to “Always” : 

oc delete pod  -lsequence=idrmapp

After executing either of the above commands the idrm pods will restart which can be monitored using :

oc get pods -w