Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM42CCD08061313E58CD6A73C8392806C80452EF564A9B5297EAD78887E47150D7
HistoryDec 28, 2021 - 8:35 p.m.

Security Bulletin: Apache Log4j vulnerability in DCNM Network Management Software used by IBM c-type SAN directors and switches.

2021-12-2820:35:34
www.ibm.com
22

0.976 High

EPSS

Percentile

100.0%

JSON

Summary

Apache Log4j Java logging library vulnerability - CVE-2021-44228 (affecting versions prior to v2.15) impacts DCNM Network Management Software.

Vulnerability Details

CVEID:CVE-2021-44228
**DESCRIPTION:**Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against attacker controlled LDAP and other JNDI related endpoints by JNDI features. By sending a specially crafted code string, an attacker could exploit this vulnerability to load arbitrary Java code on the server and take complete control of the system. Note: The vulnerability is also called Log4Shell or LogJam.
CVSS Base score: 10
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/214921 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
DCNM 11.5
DCNM 11.4
DCNM 11.3
Products Confirmed Not Vulnerable* Version(s)
IBM c-type Switches and Directors - NX-OS Firmware All
Additional Information:
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd&gt;

*Based on current information and analysis, we do not believe that IBM c-type Switches and Directors - NX-OS Firmware is impacted.

Remediation/Fixes

Affected Product(s) Version(s) Release Notes
DCNM 11.5(3) <https://www.cisco.com/c/en/us/td/docs/dcn/dcnm/1153/release-notes/cisco-dcnm-release-notes-1153/overview.html&gt;
DCNM 11.5(2) <https://www.cisco.com/c/en/us/td/docs/dcn/dcnm/1152/release-notes/cisco-dcnm-release-notes-1152/overview.html&gt;
DCNM 11.5(1) <https://www.cisco.com/c/en/us/td/docs/dcn/dcnm/1151/release-notes/cisco-dcnm-release-notes-1151/overview.html&gt;
DCNM 11.4(1) <https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/11_4_1/release_notes/b_dcnm_release_notes_11_4_1/overview.html&gt;
DCNM 11.3(1) <https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/11_3_1/release_notes/b_dcnm_release_notes_11_3_1/overview.html&gt;

Workarounds and Mitigations

None

CPENameOperatorVersion
cisco softwareeq11

Related

threatpost 41
ibm 47
rapid7blog 6
githubexploit 53
amd 1
veracode 1
nessus 8
cisa 2
akamaiblog 2
kaspersky 3
fedora 1
qualysblog 3
impervablog 2
hackerone 3
wallarmlab 2
msrc 2
trendmicroblog 1
cisa_kev 1
hivepro 1
packetstorm 4
trellix 1
talosblog 1
openvas 2
cve 1
osv 1
mssecure 1
redhat 3
debiancve 1
thn 1
ubuntu 1
zdt 1
mscve 1
malwarebytes 1
threatpost
threatpost
TA2541: APT Has Been Shooting RATs at Aviation for Years
2022-02-15 14:02:07
Microsoft Teams Targeted With Takeover Trojans
2022-02-17 14:11:48
Sextortion Rears Its Ugly Head Again
2022-02-23 17:20:41
ibm
ibm
Security Bulletin: IBM Maximo Application Suite is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)
2022-02-23 18:56:25
Security Bulletin: Content Manager OnDemand for Multiplatforms is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)
2022-07-13 12:39:40
Security Bulletin: Apache Log4j vulnerability impacts IBM Watson Knowledge Catalog in Cloud Pak for Data (CVE-2021-44228)
2022-03-21 11:39:47
rapid7blog
rapid7blog
3 Reasons to Join Rapid7’s Cloud Security Summit
2022-03-09 17:06:13
What's New in InsightVM and Nexpose: Q1 2022 in Review
2022-04-19 17:52:17
[Security Nation] Mike Hanley of GitHub on the Log4j Vulnerability
2022-01-19 21:47:30
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Apache Log4J
2022-03-14 04:09:36
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-11 13:28:52
Exploit for Deserialization of Untrusted Data in Apache Log4J
2021-12-20 10:40:32
amd
amd
AMD Response to Log4j (Log4Shell) Vulnerability
2021-12-15 00:00:00
veracode
veracode
Remote Code Execution (RCE)
2021-12-10 15:09:45
nessus
nessus
Cisco SD-WAN vManage Log4j Remote Code Execution (cisco-sa-apache-log4j-qRuKNEbd)
2022-05-16 00:00:00
VMware Horizon Log4Shell Direct Check (CVE-2021-44228) (VMSA-2021-0028)
2022-01-07 00:00:00
VMware vCenter Log4Shell Direct Check (CVE-2021-44228) (VMSA-2021-0028)
2021-12-13 00:00:00
cisa
cisa
Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems
2022-06-23 00:00:00
CISA Issues ED 22-02 Directing Federal Agencies to Mitigate Apache Log4j Vulnerabilities
2021-12-17 00:00:00
akamaiblog
akamaiblog
Threat Intelligence on Log4j CVE: Key Findings and Their Implications
2021-12-17 19:30:00
CVE-2021-44228 - Patching is Recommended for Evolving Zero Day Vulnerability in Apache Log4j that allows remote code execution (RCE)
2021-12-11 11:00:53
kaspersky
kaspersky
KLA12390 RCE vulnerability in Apache Log4j
2021-12-10 00:00:00
KLA12392 RCE vulnerability in Microsoft Azure
2021-12-16 00:00:00
KLA12395 RCE vulnerability in Microsoft SQL Server
2021-12-16 00:00:00
fedora
fedora
[SECURITY] Fedora 34 Update: log4j-2.16.0-1.fc34
2021-12-22 01:14:26
qualysblog
qualysblog
Log4Shell – Follow This Multi-Layered Approach for Detection and Remediation
2021-12-28 18:00:00
Detect Exploitation Attempts With Qualys XDR (Beta)
2021-12-14 23:55:43
Put SecOps in the Driver’s Seat with Custom Assessment and Remediation
2022-05-20 13:00:00
impervablog
impervablog
Analytics Are Essential for Effective Database Security
2022-01-13 15:23:02
Continuing to Stay Ahead of CVE-2021-44228: Addressing Your Top Questions
2021-12-14 22:55:49
hackerone
hackerone
U.S. Dept Of Defense: ███ ████████ running a vulnerable log4j
2021-12-31 00:55:49
U.S. Dept Of Defense: ██████████ running a vulnerable log4j
2021-12-11 00:16:38
Acronis: [CVE-2021-44228] nps.acronis.com is vulnerable to the recent log4shell 0-day
2021-12-13 23:42:16
wallarmlab
wallarmlab
Update on Log4Shell (CVE-2021-44228)
2021-12-10 20:22:36
5 things you need to know about Log4Shell (CVE-2021-44228)
2021-12-10 20:40:07
msrc
msrc
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2
2021-12-12 05:28:18
CVE-2021-44228 Apache Log4j 2 に対するマイクロソフトの対応
2021-12-12 08:00:00
trendmicroblog
trendmicroblog
Patch Now: Apache Log4j Vulnerability Called Log4Shell Actively Exploited
2021-12-13 00:00:00
cisa_kev
cisa_kev
Apache Log4j2 Remote Code Execution Vulnerability
2021-12-10 00:00:00
hivepro
hivepro
Iranian hackers leveraged Log4Shell to penetrate US federal agency
2022-11-17 12:28:57
packetstorm
packetstorm
Intel Data Center Manager 5.1 Local Privilege Escalation
2022-12-09 00:00:00
Log4Shell HTTP Header Injection
2022-01-12 00:00:00
MobileIron Log4Shell Remote Command Execution
2022-08-03 00:00:00
trellix
trellix
Log4J and The Memory That Knew Too Much
2022-01-19 00:00:00
talosblog
talosblog
How CVSS 4.0 changes (or doesn’t) the way we see vulnerability severity
2024-02-21 13:54:48
openvas
openvas
openSUSE: Security Advisory for logback (openSUSE-SU-2021:1613-1)
2022-02-01 00:00:00
Debian: Security Advisory (DLA-2842-1)
2021-12-13 00:00:00
cve
cve
CVE-2021-44228
2021-12-10 10:15:09
osv
osv
Critical vulnerability in log4j may affect generated PEAR projects
2021-12-16 21:01:51
mssecure
mssecure
MERCURY and DEV-1084: Destructive attack on hybrid environment
2023-04-07 16:00:00
redhat
redhat
(RHSA-2021:5126) Critical: Red Hat Integration Camel Extensions for Quarkus GA security update
2021-12-14 16:15:45
(RHSA-2021:5093) Critical: Red Hat build of Eclipse Vert.x 4.1.5 SP1 security update
2021-12-14 15:57:34
(RHSA-2021:5130) Critical: Red Hat Integration Camel-K 1.6.2 release and security update
2021-12-14 17:51:25
debiancve
debiancve
CVE-2021-44228
2021-12-10 10:15:09
thn
thn
Extremely Critical Log4J Vulnerability Leaves Much of the Internet at Risk
2021-12-11 04:18:00
ubuntu
ubuntu
Apache Log4j 2 vulnerability
2021-12-14 00:00:00
zdt
zdt
Apache Log4j 2 - Remote Code Execution Exploit
2021-12-14 00:00:00
mscve
mscve
Apache Log4j Remote Code Execution Vulnerability
2021-12-16 08:00:00
malwarebytes
malwarebytes
CISA Log4Shell warning: Patch VMware Horizon installations immediately
2022-06-27 09:54:58

0.976 High

EPSS

Percentile

100.0%

JSON
Related for 42CCD08061313E58CD6A73C8392806C80452EF564A9B5297EAD78887E47150D7
threatpost41ibm47rapid7blog6githubexploit53amd1veracode1nessus8cisa2akamaiblog2kaspersky3fedora1qualysblog3impervablog2hackerone3wallarmlab2msrc2trendmicroblog1cisa_kev1hivepro1packetstorm4trellix1talosblog1openvas2cve1osv1mssecure1redhat3debiancve1thn1ubuntu1zdt1mscve1malwarebytes1