Planning Analytics

Soufiane has commented that

"PAW uses log4j in its default configuration. Hence, the fixes in log4j 2.16 are not needed, based on our current assessment. Nonetheless, we plan to upgrade log4j to the latest version in future releases of PAW."

Thanks for this reassurance again @Soufiane Azizi

Soufiane has commented that

"PAW uses log4j in its default configuration. Hence, the fixes in log4j 2.16 are not needed, based on our current assessment. Nonetheless, we plan to upgrade log4j to the latest version in future releases of PAW."

Thanks for this reassurance again @Soufiane Azizi

We did an upgrade as well to the latest interim fix 6 for 11.1.7 and rescanned for the vulnerability afterwards. we came to the conclusion that IBM has implemented the 2.15 version of Log4j so it's still vulnerable. So be aware. We already informed IBM about this.

Soufiane has commented that

"PAW uses log4j in its default configuration. Hence, the fixes in log4j 2.16 are not needed, based on our current assessment. Nonetheless, we plan to upgrade log4j to the latest version in future releases of PAW."

Thanks for this reassurance again @Soufiane Azizi

Soufiane has commented that

"PAW uses log4j in its default configuration. Hence, the fixes in log4j 2.16 are not needed, based on our current assessment. Nonetheless, we plan to upgrade log4j to the latest version in future releases of PAW."

Thanks for this reassurance again @Soufiane Azizi

Soufiane has commented that

"PAW uses log4j in its default configuration. Hence, the fixes in log4j 2.16 are not needed, based on our current assessment. Nonetheless, we plan to upgrade log4j to the latest version in future releases of PAW."

Thanks for this reassurance again @Soufiane Azizi

HI Dean,

Have a look at Soufiane's comment here.

"Christoph, George, the current assessment of the Apache log4j Vulnerability (CVE-2021-44228) for all of Planning Analytics shows that only PAW is affected. Hence, as stated in the bulletin, the remediation for all of PA is to upgrade PAW to V2.0.71"

Soufiane has commented that

"PAW uses log4j in its default configuration. Hence, the fixes in log4j 2.16 are not needed, based on our current assessment. Nonetheless, we plan to upgrade log4j to the latest version in future releases of PAW."

Thanks for this reassurance again @Soufiane Azizi

Update December 17, 2:20 pm
IBM is focused on moving to Log4j Version 2.15 as quickly as possible for all applications impacted by CVE-2021-44228. Work also is underway to move to Log4j Version 2.16, for all impacted applications, but our priority right now is to move to at least Version 2.15.

With so much active industry research on Log4j, we will continually see mitigation and remediation recommendations. We continue to review the latest information and share updates accordingly.

HI Dean,

Have a look at Soufiane's comment here.

"Christoph, George, the current assessment of the Apache log4j Vulnerability (CVE-2021-44228) for all of Planning Analytics shows that only PAW is affected. Hence, as stated in the bulletin, the remediation for all of PA is to upgrade PAW to V2.0.71"

Soufiane has commented that

"PAW uses log4j in its default configuration. Hence, the fixes in log4j 2.16 are not needed, based on our current assessment. Nonetheless, we plan to upgrade log4j to the latest version in future releases of PAW."

Thanks for this reassurance again @Soufiane Azizi

Update December 17, 2:20 pm
IBM is focused on moving to Log4j Version 2.15 as quickly as possible for all applications impacted by CVE-2021-44228. Work also is underway to move to Log4j Version 2.16, for all impacted applications, but our priority right now is to move to at least Version 2.15.

With so much active industry research on Log4j, we will continually see mitigation and remediation recommendations. We continue to review the latest information and share updates accordingly.

HI Dean,

Have a look at Soufiane's comment here.

"Christoph, George, the current assessment of the Apache log4j Vulnerability (CVE-2021-44228) for all of Planning Analytics shows that only PAW is affected. Hence, as stated in the bulletin, the remediation for all of PA is to upgrade PAW to V2.0.71"

Soufiane has commented that

"PAW uses log4j in its default configuration. Hence, the fixes in log4j 2.16 are not needed, based on our current assessment. Nonetheless, we plan to upgrade log4j to the latest version in future releases of PAW."

Thanks for this reassurance again @Soufiane Azizi

Update December 17, 2:20 pm
IBM is focused on moving to Log4j Version 2.15 as quickly as possible for all applications impacted by CVE-2021-44228. Work also is underway to move to Log4j Version 2.16, for all impacted applications, but our priority right now is to move to at least Version 2.15.

With so much active industry research on Log4j, we will continually see mitigation and remediation recommendations. We continue to review the latest information and share updates accordingly.

HI Dean,

Have a look at Soufiane's comment here.

"Christoph, George, the current assessment of the Apache log4j Vulnerability (CVE-2021-44228) for all of Planning Analytics shows that only PAW is affected. Hence, as stated in the bulletin, the remediation for all of PA is to upgrade PAW to V2.0.71"

Soufiane has commented that

"PAW uses log4j in its default configuration. Hence, the fixes in log4j 2.16 are not needed, based on our current assessment. Nonetheless, we plan to upgrade log4j to the latest version in future releases of PAW."

Thanks for this reassurance again @Soufiane Azizi

"You are right, CVE-2021-44832 is not connected with previous Log4j vulnerability and fix for it was not included in PAW 72. CVE-2021-44832 is already reported and development team is assessing the impact on the Planning Analytics. Once they finish the assessment, corresponding bulletin will be posted via PSIRT portal.

https://www.ibm.com/trust/security-psirt

https://www.ibm.com/blogs/psirt/

APAR number:

PH43238 PLANNING ANALYTICS VULNERABILITY ASSESSMENT CVE-2021-44832

Once the fix is ready I will let you know within this case too."



Anyone about to upgrade may want to keep an eye out on Fix Central and the links above for updates

Ajay

Update December 17, 2:20 pm
IBM is focused on moving to Log4j Version 2.15 as quickly as possible for all applications impacted by CVE-2021-44228. Work also is underway to move to Log4j Version 2.16, for all impacted applications, but our priority right now is to move to at least Version 2.15.

With so much active industry research on Log4j, we will continually see mitigation and remediation recommendations. We continue to review the latest information and share updates accordingly.

HI Dean,

Have a look at Soufiane's comment here.

"Christoph, George, the current assessment of the Apache log4j Vulnerability (CVE-2021-44228) for all of Planning Analytics shows that only PAW is affected. Hence, as stated in the bulletin, the remediation for all of PA is to upgrade PAW to V2.0.71"

Soufiane has commented that

"PAW uses log4j in its default configuration. Hence, the fixes in log4j 2.16 are not needed, based on our current assessment. Nonetheless, we plan to upgrade log4j to the latest version in future releases of PAW."

Thanks for this reassurance again @Soufiane Azizi

"You are right, CVE-2021-44832 is not connected with previous Log4j vulnerability and fix for it was not included in PAW 72. CVE-2021-44832 is already reported and development team is assessing the impact on the Planning Analytics. Once they finish the assessment, corresponding bulletin will be posted via PSIRT portal.

https://www.ibm.com/trust/security-psirt

https://www.ibm.com/blogs/psirt/

APAR number:

PH43238 PLANNING ANALYTICS VULNERABILITY ASSESSMENT CVE-2021-44832

Once the fix is ready I will let you know within this case too."



Anyone about to upgrade may want to keep an eye out on Fix Central and the links above for updates

Ajay

Update December 17, 2:20 pm
IBM is focused on moving to Log4j Version 2.15 as quickly as possible for all applications impacted by CVE-2021-44228. Work also is underway to move to Log4j Version 2.16, for all impacted applications, but our priority right now is to move to at least Version 2.15.

With so much active industry research on Log4j, we will continually see mitigation and remediation recommendations. We continue to review the latest information and share updates accordingly.

HI Dean,

Have a look at Soufiane's comment here.

"Christoph, George, the current assessment of the Apache log4j Vulnerability (CVE-2021-44228) for all of Planning Analytics shows that only PAW is affected. Hence, as stated in the bulletin, the remediation for all of PA is to upgrade PAW to V2.0.71"

Soufiane has commented that

"PAW uses log4j in its default configuration. Hence, the fixes in log4j 2.16 are not needed, based on our current assessment. Nonetheless, we plan to upgrade log4j to the latest version in future releases of PAW."

Thanks for this reassurance again @Soufiane Azizi

"You are right, CVE-2021-44832 is not connected with previous Log4j vulnerability and fix for it was not included in PAW 72. CVE-2021-44832 is already reported and development team is assessing the impact on the Planning Analytics. Once they finish the assessment, corresponding bulletin will be posted via PSIRT portal.

https://www.ibm.com/trust/security-psirt

https://www.ibm.com/blogs/psirt/

APAR number:

PH43238 PLANNING ANALYTICS VULNERABILITY ASSESSMENT CVE-2021-44832

Once the fix is ready I will let you know within this case too."



Anyone about to upgrade may want to keep an eye out on Fix Central and the links above for updates

Ajay

Update December 17, 2:20 pm
IBM is focused on moving to Log4j Version 2.15 as quickly as possible for all applications impacted by CVE-2021-44228. Work also is underway to move to Log4j Version 2.16, for all impacted applications, but our priority right now is to move to at least Version 2.15.

With so much active industry research on Log4j, we will continually see mitigation and remediation recommendations. We continue to review the latest information and share updates accordingly.

HI Dean,

Have a look at Soufiane's comment here.

"Christoph, George, the current assessment of the Apache log4j Vulnerability (CVE-2021-44228) for all of Planning Analytics shows that only PAW is affected. Hence, as stated in the bulletin, the remediation for all of PA is to upgrade PAW to V2.0.71"

Soufiane has commented that

"PAW uses log4j in its default configuration. Hence, the fixes in log4j 2.16 are not needed, based on our current assessment. Nonetheless, we plan to upgrade log4j to the latest version in future releases of PAW."

Thanks for this reassurance again @Soufiane Azizi