View source for Apache Log4j & CMOD ODWEK ICN

{{TOCright}}
This article discusses IBM Content Manager OnDemand (CMOD), the OnDemand Web Enablement Kit (ODWEK), IBM Content Navigator (ICN) and the Apache Log4j library, for which a Remote Code Execution (RCE) vulnerability is actively being exploited, which can give attackers elevated access, or effective control of the affected servers.

This issue has been assigned the following designation:  CVE-2021-44228 and scores a 10 out of 10 on the Common Vulnerability Scoring System (CVSS)

There are now official TechNotes from IBM on the CMOD / Log4j issue:

[https://www.ibm.com/support/pages/node/6525888 Is IBM Content Manager OnDemand (CMOD) Version 10.5 impacted by the log4j security vulnerabilities related to CVE-2021-44228?]

[https://www.ibm.com/support/pages/node/6525892 Is IBM Content Manager OnDemand (CMOD) Version 10.1 impacted by the log4j security vulnerabilities related to CVE-2021-44228?]

If your CMOD / ODWEK / ICN solution includes WebSphere, please review the following TechNote: [https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-apache-log4j-affect-ibm-websphere-application-server-and-ibm-websphere-application-server-liberty-cve-2021-4104-cve-2021-45046 Multiple vulnerabilities in Apache log4j affect the IBM WebSphere Application Server]

UPDATE:  CMOD 10.5 FixPack 4 updates Log4j in all components.  See [[Main_Page#IBM_CMOD_Fixpacks_.26_Security_Bulletins|Content Manager OnDemand FixPacks and Security Bulletins]] for links to IBM Fix Central