Security Bulletin
Summary
A vulnerability in Apache Log4j could allow an attacker to execute arbitrary code on the system. This vulnerability may affect IBM Spectrum Scale Container Native Storage Access and IBM Spectrum Protect Plus, which are part of the IBM Spectrum Fusion appliance.
Vulnerability Details
Refer to the security bulletin(s) listed in the Remediation/Fixes section
Affected Products and Versions
| Affected Product(s) | Version(s) |
| IBM Spectrum Fusion HCI | 2.1 |
| IBM Spectrum Scale Container Native Storage Access (CNSA) | 5.1.1.3 |
| IBM Spectrum Protect Plus | 10.1.8.1 |
The IBM Spectrum Fusion HCI 2.1 appliance includes IBM Spectrum Scale Container Native Storage Access (CNSA) 5.1.1.3 and IBM Spectrum Protect Plus 10.1.8.1, which are impacted by the Apache Log4j (CVE-2021-44228).
- IBM Spectrum Scale CNSA lists a range of versions "Customers running IBM Spectrum Scale CNSA V5.1.1.1 through V5.1.2.1." but only version 5.1.1.3 is supported by IBM Spectrum Fusion HCI 2.1.
- IBM Spectrum Protect Plus lists a range of versions "10.1.0.0 - 10.1.9.0", but only version 10.1.8.1 is supported by IBM Spectrum Fusion HCI 2.1.
Refer the security bulletin links under Workarounds and Mitigations section.
Note: The IBM Spectrum Fusion HCI 2.1 management GUI is not impacted by CVE-2021-44228.
Remediation/Fixes
Refer to the instructions in the Workarounds and Mitigations section.
--->>> UPDATE 16 January 2022 <<<---
The fix for vulnerability CVE-2021-44228 is in IBM Spectrum Fusion HCI version 2.1.2
See the following page for upgrade instructions:
https://www.ibm.com/support/pages/node/6488389
Upgrading to IBM Spectrum Fusion HCI version 2.1.2 will automatically pick up and upgrade the embedded components IBM Spectrum Scale and IBM Spectrum Protect plus to remediate the log4j vulnerabilities (CVE-2021-44228, CVE-2021-45105, and CVE-2021-45046) in those components respectively.
If you upgrade to IBM Spectrum Fusion HCI v2.1.2, then you do not need to follow the workarounds specified in the Workarounds and Mitigations section below.
If you have already followed the workarounds below for CVE-2021-4428, then you will still need to upgrade to IBM Spectrum Fusion v2.1.2 to remediate CVE-2021-45105, CVE-2021-45046.
Workarounds and Mitigations
(Update: 16 January 2022: See "Update" in Remediation/Fixes section above for new instructions.)
IBM strongly recommends addressing the vulnerability now by executing these steps:
- Refer to the following security bulletin for remediation and additional vulnerability details for IBM Spectrum Scale Container Native Storage Access (CNSA) 5.1.1.3:
https://www.ibm.com/support/pages/node/6526202
IBM Spectrum Scale CNSA lists a range of versions "Customers running IBM Spectrum Scale CNSA V5.1.1.1 through V5.1.2.1." but only version 5.1.1.3 is supported by IBM Spectrum Fusion HCI 2.1.
- Refer to the following security bulletin for remediation and additional vulnerability details for IBM Spectrum Protect Plus 10.1.8.1:
https://www.ibm.com/support/pages/node/6527828
IBM Spectrum Protect Plus lists a range of versions "10.1.0.0 - 10.1.9.0", but only version 10.1.8.1 is supported by IBM Spectrum Fusion HCI 2.1.
Get Notified about Future Security Bulletins
References
Acknowledgement
Change History
22 Dec 2021: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
17 January 2022
UID
ibm16529312