PH42765: VULNERABILITY IN APACHE LOG4J AFFECTS IBM DB2 BIG SQL (CVE-2021-44228)

APAR status

• Closed as program error.

Error description

• There is a vulnerability in the Apache Log4j open source library
  used by Big SQL.  Big SQL on-premise versions 6.0.0 and
  7.1.0 are affected, as are Big SQL on CP4D versions 3.5 and 4.0.
  
  The fix for this issue is available in the most recent patches
  where the jar files have been updated.  Until the patch can be
  applied, there is a fix - a script - that can be run to update
  the jar files.  Once the patch has been applied, there is no
  need to run the script.
  
  For the on-prem versions, the script fix for this vulnerability
  consists of a tar file containing a standalone script and
  updated jar files.  The script must be run on all nodes in the
  cluster.
  
  NOTE: if you add a node to the Big SQL instance, you will need
  to run this script on the new node as well.
  
  The syntax to run the script is as follows.  As root:
  ./patch-log4j.sh <version> <big sql user>
  
  or with sudo:
  sudo ./patch-log4j.sh <version> <big sql user>
  
  where version is 6.0.0.0, or 7.1.0.0
  
  For example:
  
  1. Copy the tar file to each node in the Big SQL cluster:
  scp ibm-bigsql-apache-log4j-2.17.1-patch.tar.gz <node>:/tmp
  
  2. Unpack the tar file:
  tar -xzf ibm-bigsql-apache-log4j-2.17.1-patch.tar.gz
  
  3. Change to the newly created directory:
  cd log4j
  
  4. Make a backup of the original jar files (optional):
  find /usr/ibmpacks -name *log4j*.jar -exec tar -uvf bak.tar {}
  \;
  
  5. Run the script:
  ./patch-log4j.sh 6.0.0.0 bigsql
  
  6. Restart Big SQL
  
  The script assumes the primary group of the bigsql user is the
  "hadoop" group. If it is different, then run the following
  command after the script completes:
  chown <bigsql_user>:<primary_group>
  /usr/ibmpacks/current/bigsql/bigsql/hive-client/lib/log4j*.jar
  
  Replace <bigsql_user> and <primary_group> with the appropriate
  values for your cluster.
  

Local fix

Problem summary

• VULNERABILITY IN APACHE LOG4J AFFECTS IBM DB2 BIG SQL
  (CVE-2021-44228)
  

Problem conclusion

• Fix is available via script.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM BIG SQL

• Fixed component ID

  5737E7400

Applicable component levels