IT39896: SECURITY APAR FOR CVE-2021-42550

APAR status

• Closed as program error.

Error description

• Logback - CVE-2021-42550 (Publicly disclosed vulnerability)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Storage Insights users                                   *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * In logback version 1.2.7 and prior versions, an attacker     *
  * with the required privileges to edit configurations files    *
  * could craft a malicious configuration allowing to execute    *
  * arbitrary code loaded from LDAP servers.                     *
  *                                                              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is contained in the following release:
  
  IBM Storage Insights 1Q22   [ 54X-IBM-SI ]
  ( 1Q 2022 / March )
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TPC

• Fixed component ID

  5608TPC00

Applicable component levels