IBM Support

Instructions for Log4j remediation on the MaaS360 Enterprise Gateway

Fix Readme


Abstract

Instructions for patching the MaaS360 Mobile Enterprise Gateway (MEG) against the Log4j vulnerability in CVE-2021-44228

Content

Download the power shell script ‘MEGLog4jPatch.ps1’ to the server where the IBM MaaS360 Enterprise Gateway Module is installed. 
This shell script needs to be executed only on the Cloud Extender server where the Enterprise Gateway is configured once and may need to be re-run if customer re-installs the Cloud Extender or does a fresh install of a Cloud Extender on a new server after configuring Enterprise Gateway module. 
Steps to remove log4j library 
  1. Open powershell terminal as admin
  2. Create a folder called ‘MaaS360log4jFix’ on desktop or any other location except the Cloud Extender installation directory. 
  3. cd to that folder
  4. Run ./MEGLog4jPatch.ps1
  5. Patch-<TIMESTAMP>.log will be generated, and new backup will be copied to folder created in step 1.
  6. Please review Patch-<TIMESTAMP>.log and make sure it has only log4j files.  File paths in folder should only contain ‘org/apache/logging/log4j’ or ‘org/apache/log4j’
  7. If any issues are encountered, follow restore steps. 
Steps to restore 
In case any issue is encountered while deleting log4j, then following steps will restore old .jar. 
  1. Open powershell terminal as admin
  2. cd to same folder where you have executed command to remove log4j. 
  3. Run ./MEGLog4jPatch.ps1 restore

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSYSXX","label":"IBM MaaS360"},"ARM Category":[{"code":"a8m0z0000000717AAA","label":"MOBILE ENTERPRISE GATEWAY"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
22 December 2021

UID

ibm16527286

Page Feedback