JR64449: VULNERABILITIES IN APACHE LOG4J (CVE-2021-45105, CVE-2021-45046, AND CVE-2021-44228)

APAR status

• Closed as program error.

Error description

• CVE-2021-44228:
  An attacker who can control log messages or log message
  parameters can execute arbitrary code loaded from LDAP servers
  when message lookup substitution is enabled.
  
  CVE-2021-45046:
  It was found that the fix to address CVE-2021-44228 in Apache
  Log4j 2.15.0 was incomplete in certain non-default
  configurations. This could allows attackers with control over
  Thread Context Map (MDC) input data when the logging
  configuration uses a non-default Pattern Layout with either a
  Context Lookup (for example, $${ctx:loginId}) or a Thread
  Context Map pattern (%X, %mdc, or %MDC) to craft malicious input
  data using a JNDI Lookup pattern resulting in an information
  leak and remote code execution in some environments and local
  code execution in all environments.
  
  CVE-2021-45105:
  An attacker who has control over Thread Context Map data can
  cause a denial of service when a crafted string is interpreted.
  
  
  PRODUCTS AFFECTED
  IBM RPA with Automation Anywhere
  

Local fix

Problem summary

• No additional information is available.
  

Problem conclusion

• A fix is available or will be available that upgrades the Apache
  Log4J library to version 2.17.0.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  RPA WITH AA

• Fixed component ID

  5737E8100

Applicable component levels