Security Bulletin
Summary
IBM Cognos Analytics is affected by security vulnerabilities. Apache Log4j is used by IBM Cognos Analytics as part of its logging infrastructure. This bulletin addresses the exposure to the Apache Log4j vulnerabilities: CVE-2021-45105 and CVE-2021-44832. IBM Cognos Analytics has upgraded Apache Log4j to v2.17.1 Please note that this update also addresses CVE-2021-44228 and CVE-2021-45046.
Vulnerability Details
DESCRIPTION: Apache Log4j could allow a remote attacker with permission to modify the logging configuration file to execute arbitrary code on the system. By constructing a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI , an attacker could exploit this vulnerability to execute remote code.
CVSS Base score: 6.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/216189 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2021-45105
DESCRIPTION: Apache Log4j is vulnerable to a denial of service, caused by the failure to protect from uncontrolled recursion from self-referential lookups. A remote attacker with control over Thread Context Map (MDC) input data could craft malicious input data that contains a recursive lookup to cause a StackOverflowError that will terminate the process. Note: The vulnerability is also called LOG4J2-3230.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/215647 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
IBM Cognos Analytics 11.2.x
IBM Cognos Analytics 11.1.x
IBM Cognos Analytics 11.0.6 to 11.0.13 FP4
Remediation/Fixes
If you have one of the listed affected versions, it is strongly recommended that you apply the most recent security update.
Two links have been provided for each Interim Fix. The majority of clients will access the Interim Fix via the link under Fix Version. For clients who have IBM Cognos Analytics by way of another product such as IBM Planning Analytics, IBM Cognos Controller, IBM OpenPages, etc. you will access the Interim Fix via the link under the Bundled Customers.
|
Affected Version |
Fix Version |
Bundled Customers |
|
IBM Cognos Analytics 11.2.x |
||
|
IBM Cognos Analytics 11.1.x |
IBM Cognos Analytics 11.1.7 Interim Fix 9 | IBM Cognos Analytics 11.1.7 Interim Fix 9 (Bundled) |
|
IBM Cognos Analytics 11.0.6 to 11.0.13 FP4 |
Please note that this update also addresses CVE-2021-44228 and CVE-2021-45046.
The required remediation will be applied during the standard monthly IBM Cognos Analytics on Cloud maintenance window January 15, 2022
Workarounds and Mitigations
The IBM Cognos Analytics team have developed a “no-upgrade” option for our “On Prem” (local installation) customers.
The single version of the patch is applicable to IBM Cognos Analytics versions 11.0.6 to 11.0.13 FP4, 11.1.x and 11.2.x.
The log4jSafeAgent file that is provided for Cognos Analytics modifies the class byte code at the Java startup time. It removes the vulnerable JNDI lookup, and enforces the StrSubstitutor recursion limit without altering the installed product.
It effectively rewrites the “org/apache/logging/log4j/core/lookup/JndiLookup” class to remove its content during IBM Cognos Analytics start up.
To get the patch and detailed instructions, click this link: log4jSafeAgent
Bundle Customers can use the following link: log4jSafeAgent Bundled
Get Notified about Future Security Bulletins
References
Security Bulletin: IBM Cognos Analytics: Apache Log4j vulnerability (CVE-2021-44228)
Security Bulletin: IBM Cognos Analytics: Apache Log4j vulnerability (CVE-2021-45046)
Acknowledgement
Change History
20 April 2022 Updated Fix Version links for CA 11.x Bundle Customers to point to latest Interim Fix that address Apache log4j vulnerabilities
10 Jan 2022: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
20 April 2022
UID
ibm16538720