As you know, on December 14, 2021 ProcessMAP removed access to the Insight Reporting Tool (our reporting and data analytics platform) for all users of the ProcessMAP system.
Over the weekend, Log4j, a software commonly used by thousands of software companies, including, IBM, Microsoft, Apple, Google, Cisco, Amazon, and others was compromised.
Ref: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228
Ref: https://www.cnn.com/2021/12/15/tech/log4j-vulnerability/index.html
The ProcessMAP Insight Reporting Tool is supported on IBM Cognos version 11.1.7. IBM understands the critical nature of this issue and the need to provide a complete response for all IBM products as soon as possible. IBM’s development teams are working around the clock to complete the investigation and, as needed, any remediation on this vulnerability.
Ref:https://www.ibm.com/blogs/psirt/an-update-on-the-apache-log4j-cve-2021-44228-vulnerability/
Our security and product development team is monitoring the situation actively in consultation with the IBM technical services team. Last night, IBM released a patch to fix the vulnerabilities for Cognos and asked all its customers to install the patch to address the potential vulnerability.
We are in the process of applying and validating the patch provided by IBM for Cognos Analytics as a remediation to the potential vulnerability.
Access to the Insight Reporting Tool is not available until proper remediation to the potential vulnerability is in place.
However, we have activated all jobs that are setup for report subscriptions. Users who have requested the system to send them automated reports via Excel or PDF will continue to receive the data via email beginning this morning. Any subscription changes will be allowed once access to the Insight Reporting Tool is enabled.
ProcessMAP’s Customer Success team will keep you posted on any updates as they are made available.
Thank you and we appreciate your support.