Critical Severity

Security Bulletin: Vulnerabilities in Apache Log4j affects IBm Edge Application Manager (CVE-2021-45105 and CVE-2021-45046)

Share this post:

IBM Edge Application Manager (IEAM) 4.3.1 contains two dependencies that are affected by the Apache Log4j vulnerabilities described in CVE-2021-45105 and CVE-2021-45046. Note that IBM Edge Application Manager does not use Log4j directly. The first relates to code included in Intel Secure Device Onboarding (SDO) which is open-source code that IEAM uses to help with onboarding devices into an IEAM cluster. The other is a dependency on IBM Cloud Pak Foundational Services (IBM Common Services) which includes an unused Operator that contains a vulnerable version of Log4j. This bulletin provides a remediation for both vulnerabilities, CVE-2021-45105 and CVE-2021-45046, by upgrading IBM Edge Application Manager to the latest version. This includes updates to Log4j to version 2.17 which addresses any potential exposure to the Log4j vulnerabilities.

CVE(s): CVE-2021-45105, CVE-2021-45046

Affected product(s) and affected version(s):

Affected Product(s) Version(s)
IBM Edge Application Manger 4.3

Refer to the following reference URLs for remediation and additional vulnerability details:  
Source Bulletin: https://www.ibm.com/support/pages/node/6540694
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/215647
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/215195

More stories

Security Bulletin: IBM Tivoli Monitoring is vulnerable to remote code execution and denial of service due to multiple Expat CVEs

May 20, 2022 | Critical Severity

The libexpart parser that is used by IBM Tivoli Monitoring for parsing various configuration xml files and parsing soap requests is potentially vulnerable to the following remote code execution CVE's: CVE-2021-46143 CVE-2022-25314 CVE-2022-23990 CVE-2022-22825 CVE-2022-23852 CVE-2022-22824 CVE-2022-22823 CVE-2022-22826 CVE-2022-22827 CVE-2022-22822 CVE-2022-25315 and the following denial of service CVE's: CVE-2021-45960 CVE-2022-25236 CVE-2022-25235 CVE-2022-25313. Most of the vulnerabilities would require the system to be locally compromised such that a bad actor could modify file locally. ...read more


Security Bulletin: IBM Cloud Private is vulnerable to server-side request forgery due to Python (CVE-2021-29921)

May 20, 2022 | Critical Severity

There is a vulnerability in Python open source used by IBM Cloud Private for scripting. The vulnerability could be exploited by an attacker to conduct SSRF or local file include attacks. This bulletin identifies the security fixes to apply to address the Python vulnerability (CVE-2021-29921) ...read more


Security Bulletin: TXSeries for Multiplatforms is vulnerable to arbitrary code execution due to IBM WebSphere Application Server Liberty (CVE-2021-23450)

May 20, 2022 | Critical Severity

WebSphere Application Server Liberty is used by TXSeries for Multiplatforms to provide a web based administration console. The fix removes the arbitrary code execution vulnerability CVE-2021-23450 from Liberty. ...read more