Hello ,

shortly after the Apache log4j bug (CVE-2021-44228) became known, we have checked current Informix versions for the corresponding files. It quickly became clear that the actual database server is not at risk, but that "Informix HQ", the administration tool delivered by IBM with the database, may be affected.

An official statement from IBM regarding the vulnerability of Informix was not made during the first few days. We advised our Informix customers at short notice not to start Informix HQ. Upon request, we provided a workaround by disabling the critical classes.

For those administrators who are using the Admin-Scout for Informix from our company, there was no need for action - the Admin-Scout does not use any Java libraries.

As of January 7, IBM is now making official fix packs available for download through IBM Fix Central.

The CVE-2021-44228 vulnerability affects users running Informix HQ 1.5.0 in Informix versions 14.10.FC6 / 14.10.FC7 or 12.10.xC15. Informix HQ uses Apache Log4j 2.14.0.

The downloads are posted at the following links:

• Informix 14.10.FC7W1 is the fix release for versions 14.10.FC6 or 14.10.FC7. (Download via Fix Central or for our customers in the download area of our website).

• For the Informix 12.10.xC15 version, only a download of the affected .jar files informixhq-server and informixhq-agent is offered (download via Fix Central). Alternatively, the jar files can also be taken from the 14.10.FC7W1 Developer Edition.

For more information on the fix packs, Scott Pickett (IBM Informix WW Technical Sales) gives a good summary in the IBM Hybrid Data Management Community. You can access the post here in the IBM Community!

With best regards from Giessen,

Your CURSOR Service Distribution Team

---

Informix 14.10.FC7W1 - currently available:

• Informix Developer Edition V14.10.FC7W1

  The corresponding edition installers of 14.10.FC7 have not changed and can be used for 14.10FC7W1 too.

---