Knowledge Article

Article Number

000391322

Old Article Number

Article Type

FAQ/Procedural

Title

How to remediate the Apache Log4j vulnerabilities CVE-2021-44228, CVE-2021-45046, and CVE-2021-45105 within Control-M?

Summary

Product

Control-M/Enterprise Manager

Component

Control-M/Enterprise Manager

Applies to

Control-M distributed products ; version 9.0.18, 9.0.19, 9.0.20, 9.0.21

Question

How to remediate the Apache Log4j vulnerabilities CVE-2021-44228, CVE-2021-45046, and CVE-2021-45105 within Control-M?

Issues:
A zero-day exploit for the following vulnerabilities was publicly released: 

CVE-2021-44228 (code named Log4Shell) on December 9th, 2021
CVE-2021-45046 on December 14th, 2021
CVE-2021-45105 December 18th, 2021

Answer

Updated December 29, 2021

A detailed description of the vulnerabilities can be found here: Apache Log4j Security Vulnerabilities.

Follow the BMC Security Advisory Note on BMC Community for continuous updates and details about this issue.

Ensure you are subscribed to Proactive Notifications at bmc.com to be notified of future updates about this vulnerability.

Control-M products NOT affected:
Control-M Advanced File Transfer
Control-M Application Pack
Control-M Agents for Tandem, Unisys and AS/400
All INCONTROL for z/OS family of products
Control-D/WebAccess Server, Control-D Delivery Server, Control-D Agents
Control-M Conversion Tool
Control-M/Enterprise Manager Workload Automation client
Control-M/Enterprise Manager Control-M Configuration (CCM) client
Control-M Plug-ins (see last table below)

Control-M products AFFECTED:
See the following tables

9.0.21 Components
The following table lists the affected components in version 9.0.21:

Component	Vulnerable	Additional Information
Control-M/EM server Control-M Add-ons	No	See 000392046 regarding information about backup files from previous versions
Control-M/Server	No	See 000392048 regarding information about backup files from previous versions
Control-M/Agent	No	See 000391425 regarding information about backup files from previous versions
Control-M MFT	No	See 000392051 regarding information about backup files from previous versions
Control-M MFTE Gateway	No	See 000392051 regarding information about backup files from previous versions
Control-M Automation API	No	See 000392194 regarding information about backup files from previous versions

9.0.20 Components

The following table lists the affected components in version 9.0.20:

Component	Vulnerable	Log4J2 Remediation
Control-M/EM server Control-M Add-ons	Yes	See 000392046
Control-M/Server	Yes	See 000392048
Control-M/Agent	Yes	See options A & B in 000391425 for remediation options
Control-M MFT	Yes	See 000392051
Control-M MFTE Gateway	Yes	See 000392051
Control-M Automation API	Yes	See 000392194

9.0.19 Components

The following table lists the affected components in version 9.0.19:

Component	Vulnerable	Log4J2 Remediation
Control-M/EM server Control-M Add-ons	Yes	See 000392046
Control-M/Server	Yes	See 000392048
Control-M/Agent	Yes	See options A & B in 000391425 for remediation options
Control-M MFT	Yes	See 000392051
Control-M MFTE Gateway	Yes	See 000392051

9.0.18 Components

The following table lists the affected components in version 9.0.18:

Component	Vulnerable	Log4J2 Remediation
Control-M/EM server Control-M Add-ons	Yes	See 000392046
Control-M/Server	Yes	See 000392048
Control-M MFT	Yes	See 000392051
Control-M MFTE Gateway	Yes	See 000392051
Control-M/Agent	No	Version 9.0.18 Control-M/Agent is not affected

Control-M Plug-ins

The following table lists the plug-ins that are not affected by this vulnerability:

Component	Vulnerable
Control-M for Oracle Retail	No
Control-M for Oracle BI	No
Control-M for PeopleSoft	No
Control-M for SAP	No
Control-M for Oracle E-Business Suite	No
Control-M for Web Services, Java and Messaging	No
Control-M for Cloud	No
Control-M for Cognos	No
Control-M for IBM InfoSphere DataStage	No
Control-M for SAP Business Objects	No
Control-M for AFT	No

Note: After remediation, when upgrading to a higher level Fix Pack or a Version (below 9.0.21), these same remediation steps need to be repeated. An upgrade to a higher release will overwrite the log4j remediated libraries and therefore the remediation procedure needs to be repeated.

Attachment(s):