RE: Remote code execution exploit found in Log4j - CVE-2021-44228

I don't have "WebSphere" in /qibm/proddata.

I have QWEBQRY

My IBM BP says we are running an "Integrated" version of Websphere.

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Rob Berendt
Sent: Monday, December 13, 2021 12:33 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: RE: Remote code execution exploit found in Log4j - CVE-2021-44228

Yes, finding the exact version of WAS you're running is a dark art. It's too hidden to bother showing it on the admin pages (sarcasm to IBM intended).

Start out with:
WRKLNK '/QIBM/ProdData/WebSphere/AppServer/*'
On my 7.4 system I see V85. Drill into that.
Then you should see what kind(s) you have. I have Express. Drill into your kind.
Then select bin. You will end up with something like:
/QIBM/ProdData/WebSphere/AppServer/V85/Express/bin

Fire up STRQSH
Then modify the following to match your information
/QIBM/ProdData/WebSphere/AppServer/V85/Express/bin/versionInfo
If you get the following message then you <fouled> up when upgrading and ignored prereq's to modify WAS before the upgrade:
/QIBM/ProdData/WebSphere/AppServer/V85/Express/bin/versionInfo: 001-0014 Command /QOpenSys/QIBM/ProdData/JavaVM/jdk626/32bit/bin/
java not found.
Well, duh, you're not going to find Java 6 at 7.3 or above. I did this boneheaded move.
So you're going to have to fix that to use the right java as per
https://www.ibm.com/support/pages/how-fix-websphere-application-server-v85-after-upgrading-ibm-i-v7r3-os

That same link has a back door to find the WAS version:
EDTF '/qibm/proddata/websphere/appserver/v85/Express/properties/version/was.product'
On my system it shows: <version>8.5.5.8</version>

If you can finally get that versionInfo to work there are flags on the command to show you fix packs and ifixes. Details at:
https://www.ibm.com/docs/en/was/9.0.5?topic=tools-versioninfo-command
You'll need to know this for this particular issue!

For more fun:
https://www.ibm.com/support/pages/fix-list-ibm-websphere-application-server-v85


"No man is completely worthless, he can always be used as a bad example." Sometimes I fit that bill...


Rob Berendt