Apache Log4j & CMOD ODWEK ICN - Revision history

Jderrick: Removed Q&A section.

2024-06-17T14:33:18Z

Removed Q&A section.

← Older revision		Revision as of 14:33, 17 June 2024
Line 85:		Line 85:

	Please refer to IBM's Technotes for [https://www.ibm.com/support/pages/node/6525892 v10.1] and [https://www.ibm.com/support/pages/node/6525888 v10.5] for instructions on upgrading log4j on your CMOD and ODWEK installations.		Please refer to IBM's Technotes for [https://www.ibm.com/support/pages/node/6525892 v10.1] and [https://www.ibm.com/support/pages/node/6525888 v10.5] for instructions on upgrading log4j on your CMOD and ODWEK installations.

	~~== Questions & Responses ==~~

	~~If you have questions you'd like to see answered, find us on Twitter: https://Twitter.com/CMODwiki~~

	~~Discuss on LinkedIn: https://www.linkedin.com/posts/justinderrick_apache-log4j-cmod-odwek-icn-activity-6875483828106932224-ledY~~

	~~Discuss on the Content Manager OnDemand User Group Forums: http://www.odusergroup.org/forums/index.php/topic,3221.0.html~~

Jderrick: Link needed link text.

2022-01-27T21:34:20Z

Link needed link text.

← Older revision		Revision as of 21:34, 27 January 2022
Line 33:		Line 33:
	== Versions Shipped with CMOD ==		== Versions Shipped with CMOD ==

	'''''NOTE:''''' CMOD Fixpacks with the Log4j patch have been released: [[Main_Page#IBM_CMOD_Fixpacks_.26_Security_Bulletins]]		'''''NOTE:''''' CMOD Fixpacks with the Log4j patch have been released: [[Main_Page#IBM_CMOD_Fixpacks_.26_Security_Bulletins\|CMOD Fixpacks for Log4j]]

	{\| class="mw-collapsible wikitable" style="text-align: center;		{\| class="mw-collapsible wikitable" style="text-align: center;

Jderrick: /* Versions Shipped with CMOD */

2022-01-27T21:33:35Z

Versions Shipped with CMOD

← Older revision		Revision as of 21:33, 27 January 2022
Line 32:		Line 32:

	== Versions Shipped with CMOD ==		== Versions Shipped with CMOD ==

			'''''NOTE:''''' CMOD Fixpacks with the Log4j patch have been released: [[Main_Page#IBM_CMOD_Fixpacks_.26_Security_Bulletins]]

	{\| class="mw-collapsible wikitable" style="text-align: center;		{\| class="mw-collapsible wikitable" style="text-align: center;
	!CMOD Version\|\|Apache Log4j version(s)\|\|Vulnerable version? \|\|Comment		!CMOD Version\|\|Apache Log4j version(s)\|\|Vulnerable version? \|\|Comment
Line 52:		Line 55:
	\|style="text-align: left;\|ICN v3 is not vulnerable in the default configuration, but sites that have enabled the JMSAppender feature could be exploited.		\|style="text-align: left;\|ICN v3 is not vulnerable in the default configuration, but sites that have enabled the JMSAppender feature could be exploited.
	\|}		\|}



	== Impact ==		== Impact ==

Jderrick: Added link to CMOD 10.5 Fix Pack 4 Log4j fix

2022-01-27T15:57:25Z

Added link to CMOD 10.5 Fix Pack 4 Log4j fix

← Older revision		Revision as of 15:57, 27 January 2022
Line 11:		Line 11:

	If your CMOD / ODWEK / ICN solution includes WebSphere, please review the following TechNote: [https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-apache-log4j-affect-ibm-websphere-application-server-and-ibm-websphere-application-server-liberty-cve-2021-4104-cve-2021-45046 Multiple vulnerabilities in Apache log4j affect the IBM WebSphere Application Server]		If your CMOD / ODWEK / ICN solution includes WebSphere, please review the following TechNote: [https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-apache-log4j-affect-ibm-websphere-application-server-and-ibm-websphere-application-server-liberty-cve-2021-4104-cve-2021-45046 Multiple vulnerabilities in Apache log4j affect the IBM WebSphere Application Server]

			UPDATE: CMOD 10.5 FixPack 4 updates Log4j in all components. See [[Main_Page#IBM_CMOD_Fixpacks_.26_Security_Bulletins\|Content Manager OnDemand FixPacks and Security Bulletins]] for links to IBM Fix Central

	== Announcements ==		== Announcements ==

Jderrick: Added WebSphere link...

2021-12-22T12:40:42Z

Added WebSphere link...

← Older revision		Revision as of 12:40, 22 December 2021
Line 9:		Line 9:

	[https://www.ibm.com/support/pages/node/6525892 Is IBM Content Manager OnDemand (CMOD) Version 10.1 impacted by the log4j security vulnerabilities related to CVE-2021-44228?]		[https://www.ibm.com/support/pages/node/6525892 Is IBM Content Manager OnDemand (CMOD) Version 10.1 impacted by the log4j security vulnerabilities related to CVE-2021-44228?]

			If your CMOD / ODWEK / ICN solution includes WebSphere, please review the following TechNote: [https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-apache-log4j-affect-ibm-websphere-application-server-and-ibm-websphere-application-server-liberty-cve-2021-4104-cve-2021-45046 Multiple vulnerabilities in Apache log4j affect the IBM WebSphere Application Server]

	== Announcements ==		== Announcements ==

Jderrick: Added more information about CMOD components affected by the vulnerability...

2021-12-15T22:55:08Z

Added more information about CMOD components affected by the vulnerability...

← Older revision		Revision as of 22:55, 15 December 2021
Line 55:		Line 55:

	; Which CMOD components use Apache log4j?		; Which CMOD components use Apache log4j?
	: The three components that use the log4j library are the ODWEK Java API, the REST API (new in CMOD v10.5) and the Full Text Search engine.		: The three components that use the log4j library are the ODWEK Java API, the REST API (new in CMOD v10.5) and the Full Text Search engine. The CMOD server itself doesn't use log4j, so none of the standard operations a CMOD server performs are vulnerable to this exploit, this includes, loading data with arsload, indexing documents with ACIF or the PDF Indexer, migrating data between cache & secondary storage, etc.

	; How does ODWEK Java API / REST API / FTS use the log4j library?		; How does ODWEK Java API / REST API / FTS use the log4j library?

Jderrick: Linked to log4j download page, and added both IBM CMOD v10 technotes.

2021-12-15T14:25:50Z

Linked to log4j download page, and added both IBM CMOD v10 technotes.

← Older revision		Revision as of 14:25, 15 December 2021
Line 76:		Line 76:
	* CMOD and ODWEK running on the same server instance / operating system & accessible to the internet: ''Medium''		* CMOD and ODWEK running on the same server instance / operating system & accessible to the internet: ''Medium''

	== Upgrading log4j v2.15.x ==		== Upgrading log4j v2.16.x ==
			You can download the latest version of Apache log4j here: https://logging.apache.org/log4j/2.x/download.html

	Please refer to [https://www.ibm.com/support/pages/node/6525888 ~~IBM's technote~~] for instructions on upgrading log4j on your CMOD installations.		Please refer to IBM's Technotes for [https://www.ibm.com/support/pages/node/6525892 v10.1] and [https://www.ibm.com/support/pages/node/6525888 v10.5] for instructions on upgrading log4j on your CMOD and ODWEK installations.

	== Questions & Responses ==		== Questions & Responses ==

Jderrick: Recommended to upgrade to 2.16+.

2021-12-15T14:22:51Z

Recommended to upgrade to 2.16+.

← Older revision		Revision as of 14:22, 15 December 2021
Line 25:		Line 25:
	Versions from v2.0 beta9 through 2.14.x are vulnerable to this exploit.		Versions from v2.0 beta9 through 2.14.x are vulnerable to this exploit.

	~~The version that includes the fix is v2~~.~~15.x~~ and ~~above, released December 10th, 2021~~.		Your systems should be patched to log4j 2.16 or higher - a second vulnerability was discovered, and the latest versions disables the features by default.

	== Versions Shipped with CMOD ==		== Versions Shipped with CMOD ==

Jderrick: Updated with IBM Technote on CMOD log4j - reformatted table and added Comment Field.

2021-12-14T14:02:10Z

Updated with IBM Technote on CMOD log4j - reformatted table and added Comment Field.

← Older revision		Revision as of 14:02, 14 December 2021
Line 4:		Line 4:
	This issue has been assigned the following designation: CVE-2021-44228 and scores a 10 out of 10 on the Common Vulnerability Scoring System (CVSS)		This issue has been assigned the following designation: CVE-2021-44228 and scores a 10 out of 10 on the Common Vulnerability Scoring System (CVSS)

	There is now an official ~~technote~~ from IBM on the CMOD / Log4j issue: https://www.ibm.com/support/pages/node/6525888		There are now official TechNotes from IBM on the CMOD / Log4j issue:

			[https://www.ibm.com/support/pages/node/6525888 Is IBM Content Manager OnDemand (CMOD) Version 10.5 impacted by the log4j security vulnerabilities related to CVE-2021-44228?]

			[https://www.ibm.com/support/pages/node/6525892 Is IBM Content Manager OnDemand (CMOD) Version 10.1 impacted by the log4j security vulnerabilities related to CVE-2021-44228?]

	== Announcements ==		== Announcements ==
Line 25:		Line 29:
	== Versions Shipped with CMOD ==		== Versions Shipped with CMOD ==
	{\| class="mw-collapsible wikitable" style="text-align: center;		{\| class="mw-collapsible wikitable" style="text-align: center;
	!CMOD Version\|\|Apache Log4j version(s)\|\|Vulnerable version?		!CMOD Version\|\|Apache Log4j version(s)\|\|Vulnerable version? \|\|Comment
	\|-		\|-
	\|CMOD & ODWEK v9.0\|\| N/A \|\| ~~<span~~ style="~~color~~: ~~green~~;~~>NO</span>~~		\|CMOD & ODWEK v9.0\|\| N/A \|\| N/A
			\|style="text-align: left;\|Log4j isn't used in CMOD v9.
	\|-		\|-
	\|CMOD & ODWEK v9.5\|\| N/A \|\| ~~<span~~ style="~~color~~: ~~green~~;~~>NO</span>~~		\|CMOD & ODWEK v9.5\|\| N/A \|\| N/A
			\|style="text-align: left;\|Log4j isn't used in CMOD v9.
	\|-		\|-
	\|CMOD & ODWEK v10.1\|\| v2.6.x \|\| <span style="color: red;>YES</span>		\|CMOD & ODWEK v10.1\|\| v2.6.x \|\| <span style="color: red;>YES</span>
			\|style="text-align: left;\|Log4j is only included with CMOD v10.1 FP6 and higher.</span>
	\|-		\|-
	\|CMOD & ODWEK v10.5\|\| v2.13.x\|\| <span style="color: red;>YES</span>		\|CMOD & ODWEK v10.5\|\| v2.13.x\|\| <span style="color: red;>YES</span>
			\|style="text-align: left;\|Log4j is included in the base level and all Fixpacks of CMOD v10.5.</span>
	\|-		\|-
	\|ICN v2.0.3 \|\| TBD \|\| TBD		\|ICN v2.0.3 \|\| TBD \|\| TBD
	\|-		\|-
	\|ICN v3\|\| v1.2.x \|\| <span style="color: green;>NO</span>		\|ICN v3\|\| v1.2.x \|\| <span style="color: green;>NO</span>
			\|style="text-align: left;\|ICN v3 is not vulnerable in the default configuration, but sites that have enabled the JMSAppender feature could be exploited.
	\|}		\|}

	~~ICN v3 is not vulnerable in the default configuration, but sites that have enabled the JMSAppender feature could be exploited.~~

	== Impact ==		== Impact ==

Jderrick: One last edit.

2021-12-13T22:11:04Z

One last edit.

← Older revision		Revision as of 22:11, 13 December 2021
Line 4:		Line 4:
	This issue has been assigned the following designation: CVE-2021-44228 and scores a 10 out of 10 on the Common Vulnerability Scoring System (CVSS)		This issue has been assigned the following designation: CVE-2021-44228 and scores a 10 out of 10 on the Common Vulnerability Scoring System (CVSS)

	~~Follow~~ the ~~upgrade instructions here~~: ~~[[Apache_Log4j_%26_CMOD_ODWEK_ICN#Upgrading_log4j_v2~~.15.~~x\|Upgrading log4j]]~~		There is now an official technote from IBM on the CMOD / Log4j issue: https://www.ibm.com/support/pages/node/6525888

	== Announcements ==		== Announcements ==