RE: Remote code execution exploit found in Log4j .....

[Greg Wilburn <gwilburn@xxxxxxxxxxxxxxxxxxxxxxx>]

I have a "big mouth" and can be a real a$$hole sometimes.  But I'm sure I'm not the only one.

Notice DB2 Web Query is not listed.  
But IBM i and IBM i HTTP???  What does that mean?



-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Charles Wilt
Sent: Wednesday, December 15, 2021 10:03 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: Remote code execution exploit found in Log4j .....

IBM Heard you...
https://www.ibm.com/blogs/psirt/an-update-on-the-apache-log4j-cve-2021-44228-vulnerability/#list-of-products

Charles

On Wed, Dec 15, 2021 at 7:38 AM Greg Wilburn <
gwilburn@xxxxxxxxxxxxxxxxxxxxxxx> wrote:

> I understand IBM communicating through the PSIRT blog...
>
> But telling customers only what is vulnerable and in need of a patch is
> only 1/2 the story.  IBM needs to also include information on what they've
> reviewed that is NOT (or likely not) vulnerable.
>
> In my case, we've taken down access to the DB2 Web Query portal... It
> isn't mentioned anywhere in the blog as being vulnerable.  But has IBM
> reviewed it?  When can I make this accessible again?
>
> If it's been looked at and likely OK, I need to know that.
> If I need to keep it down for a week, a month, etc.  I will.
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: https://amazon.midrange.com