cisco-sa-apache-log4j-qruknebd
Vulnerability from csaf_cisco
Published
2021-12-10 18:45
Modified
2022-01-31 21:16
Summary
Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021

Notes

Summary
Critical Vulnerabilities in Apache Log4j Java Logging Library On December 9, 2021, the following critical vulnerability in the Apache Log4j Java logging library affecting all Log4j2 versions earlier than 2.15.0 was disclosed: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints On December 14, 2021, the following critical vulnerability, which affects certain Apache Log4j use cases in versions 2.15.0 and earlier, was disclosed: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack On December 18, 2021, a vulnerability in the Apache Log4j component affecting versions 2.16 and earlier was disclosed: CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation On December 28, 2021, a vulnerability in the Apache Log4j component affecting versions 2.17 and earlier was disclosed: CVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration For a description of these vulnerabilities, see the Apache Log4j Security Vulnerabilities ["https://logging.apache.org/log4j/2.x/security.html"] page. Cisco's Response to These Vulnerabilities Cisco assessed all products and services for impact from both CVE-2021-44228 and CVE-2021-45046. To help detect exploitation of these vulnerabilities, Cisco has released Snort rules at the following location: Talos Rules 2021-12-21 ["https://www.snort.org/advisories/talos-rules-2021-12-21"] Product fixes that are listed in this advisory will address both CVE-2021-44228 and CVE-2021-45046 unless otherwise noted. Cisco has reviewed CVE-2021-45105 and CVE-2021-44832 and has determined that no Cisco products or cloud offerings are impacted by these vulnerabilities. Cisco's standard practice is to update integrated third-party software components to later versions as they become available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd ["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"]
Affected Products
Cisco investigated its product line to determine which products may be affected by these vulnerabilities. This advisory only lists Cisco products and services that are known to include the impacted software component and thus may be vulnerable. Products and services that do not contain the impacted software component are not vulnerable and therefore are not listed in this advisory. Any Cisco product or service that is not explicitly listed in the Affected Products section of this advisory is not affected by the vulnerability or vulnerabilities described. The Vulnerable Products ["#vp"] section includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool and contain additional platform-specific information, including workarounds (if available) and fixed software releases.
Vulnerable Products
Cisco investigated its product line to determine which products may be affected by these vulnerabilities. The following table lists Cisco products that are affected by one or both of the vulnerabilities that are described in this advisory. Customers should refer to the associated Cisco bug(s) for further details. Product Cisco Bug ID Fixed Release Availability ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"] Collaboration and Social Media Cisco Webex Meetings Server CSCwa47283 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47283"] CWMS-3.0MR4SP3 patch (21 Dec 2021) CWMS-4.0MR4SP3 patch (21 Dec 2021) CWMS-3.0MR4SP2 patch (14 Dec 2021) CWMS-4.0MR4SP2 patch (14 Dec 2021) Endpoint Clients and Client Software Cisco CX Cloud Agent Software CSCwa47272 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47272"] 1.12.2 (17 Dec 2021) Network Application, Service, and Acceleration Cisco Call Studio CSCwa54008 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa54008"] 11.6(2) (23 Dec 2021) 12.0(1) (23 Dec 2021) 12.5(1) (23 Dec 2021) 12.6(1) (23 Dec 2021) Cisco Nexus Insights CSCwa47284 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47284"] 6.0.2 (17 Dec 2021) Network and Content Security Devices Cisco Firepower Threat Defense (FTD) managed by Firepower Device Manager (FDM) CSCwa46963 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa46963"] 6.2.3 hotfix (Available) 6.4.0 hotfix (Available) 6.6.5 hotfix (Available) 6.7.0 hotfix (Available) 7.0.1 hotfix (Available) 7.1.0 hotfix (Available) Cisco Identity Services Engine (ISE) CSCwa47133 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47133"] 2.4 hotfix (15 Dec 2021) 2.6 hotfix (15 Dec 2021) 2.7 hotfix (15 Dec 2021) 3.0 hotfix (15 Dec 2021) 3.1 hotfix (17 Dec 2021) Network Management and Provisioning Cisco Application Policy Infrastructure Controller (APIC) - Network Insights Base App CSCwa47295 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47295"] 4.2(7r) (Available) 5.2(3g) (Available) Cisco Automated Subsea Tuning CSCwa48806 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa48806"] 2.1.0.4 (22 Dec 2021) Cisco Business Process Automation CSCwa47269 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47269"] 3.0.000.115 (patch) (17 Dec 2021) 3.1.000.044 (patch) (17 Dec 2021) 3.2.000.009 (patch) (17 Dec 2021) Cisco CloudCenter Cost Optimizer CSCwa48074 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa48074"] 5.5.2 (Available) Cisco CloudCenter Suite Admin CSCwa47349 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47349"] 5.3.1 (Available) Cisco CloudCenter Workload Manager CSCwa47350 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47350"] 5.5.2 (Available) Cisco CloudCenter CSCwa48832 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa48832"] 4.10.0.16 (22 Dec 2021) Cisco Common Services Platform Collector (CSPC) CSCwa47271 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47271"] 2.10.0.1 hotfix (Available) 2.9.1.3 hotfix (Available) Cisco Crosswork Data Gateway CSCwa47257 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47257"] 2.0.2 patch (21 Dec 2021) 3.0.1 patch (21 Dec 2021) Cisco Crosswork Network Controller CSCwa49936 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa49936"] 2.0.1 patch (22 Dec 2021) 3.0.1 patch (22 Dec 2021) Cisco Crosswork Optimization Engine CSCwa49939 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa49939"] 2.0.1 patch (21 Dec 2021) 3.0.1 patch (21 Dec 2021) Cisco Crosswork Platform Infrastructure CSCwa47367 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47367"] 4.0.1 patch (22 Dec 2021) 4.1.1 patch (22 Dec 2021) Cisco Crosswork Situation Manager CSCwa51878 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa51878"] 8.0.0.8 patch (21 Dec 2021) Cisco Crosswork Zero Touch Provisioning (ZTP) CSCwa47259 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47259"] 2.0.1 patch (21 Dec 2021) 3.0.1 patch (21 Dec 2021) Cisco Cyber Vision Sensor Management Extension CSCwa49482 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa49482"] 4.0.3 (22 Dec 2021) Cisco DNA Spaces Connector CSCwa47320 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47320"] v2.0.588 (Available) v2.2.12 (Available) Cisco Data Center Network Manager (DCNM) CSCwa47291 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47291"] 12.0(2f) (Available) 11.5(3) patch (Available) 11.5(2) patch (Available) 11.5(1) patch (Available) 11.4(1) patch (Available) 11.3(1) patch (Available) Cisco Evolved Programmable Network Manager CSCwa47310 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47310"] 5.1.3.1 patch (22 Dec 2021) 5.0.2.1 patch (13 Jan 2022) 4.1.1.1 patch (13 Jan 2022) Cisco Intersight Virtual Appliance CSCwa47304 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47304"] 1.0.9-361 (20 Dec 2021) Cisco Network Services Orchestrator (NSO) CSCwa47342 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47342"] nso-5.3.5.1 (17 Dec 2021) nso-5.4.5.2 (17 Dec 2021) nso-5.5.4.1 (17 Dec 2021) nso-5.6.3.1 (17 Dec 2021) Cisco Nexus Dashboard, formerly Cisco Application Services Engine CSCwa47299 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47299"] 2.1.2 (23 Dec 2021) Cisco Prime Service Catalog CSCwa47347 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47347"] 12.1 patch (20 Dec 2021) Cisco Secure Agile Exchange (SAE) Core Function Pack CSCwa52921 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa52921"] 2.4.1 (14 Jan 2022) Cisco Smart PHY CSCwa50021 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa50021"] 3.1.4 patch (Available) 3.2.0 patch (Available) 3.2.1 patch (Available) 21.3 patch (21 Jan 2022) Cisco Virtual Topology System (VTS) CSCwa47334 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47334"] 2.6.7 (22 Dec 2021) Cisco Virtualized Infrastructure Manager CSCwa49924 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa49924"] 3.2.x patch (17 Dec 2021) 3.4.4 patch (17 Dec 2021) 3.4.6 patch (17 Dec 2021) 4.2.0 patch (17 Dec 2021) 4.2.1 patch (17 Dec 2021) Cisco WAN Automation Engine (WAE) CSCwa47369 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47369"] 7.5.0.1 (22 Dec 2021) 7.4.0.1 (28 Jan 2022) 7.3.0.2 (28 Jan 2022) Routing and Switching - Enterprise and Service Provider Cisco DNA Center CSCwa47322 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47322"] 2.2.2.8 patch (Available) 2.1.2.8 patch (Available) 2.2.3.4 patch (Available) Cisco IOx Fog Director CSCwa47370 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47370"] 1.14.5 patch (16 Dec 2021) 1.16.4 patch (Available) Cisco Network Assurance Engine CSCwa47285 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47285"] 6.0.2 (23 Dec 2021) Cisco Network Convergence System 1004 CSCwa52235 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa52235"] 7.3.2 SMU/GISO (14 Jan 2022) 7.3.1 SMU (21 Jan 2022) Cisco Optical Network Controller CSCwa48793 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa48793"] 1.1.0 (22 Dec 2021) Cisco SD-WAN vManage CSCwa47745 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47745"] 20.3.4.1 (Available) 20.6.2.1 (Available) 20.5.1.1 (Available) 20.4.2.1 (Available) Unified Computing Cisco Integrated Management Controller (IMC) Supervisor CSCwa47307 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47307"] 2.3.2.1 (23 Dec 2021) Cisco UCS Central Software CSCwa47303 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47303"] 2.0(1p) (22 Dec 2021) Cisco UCS Director CSCwa47288 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47288"] 6.8.2.0 (23 Dec 2021) Cisco Workload Optimization Manager CSCwa50220 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa50220"] 3.2.1 patch (Available) Voice and Unified Communications Devices Cisco BroadWorks CSCwa47315 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47315"] 2021.11_1.162 (13 Dec 2021) ap381882 (15 Dec 2021) Cisco Cloud Connect CSCwa51545 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa51545"] 12.6(1) (Available) Cisco Contact Center Domain Manager (CCDM) CSCwa47383 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47383"] 12.5(1) ES6 (Available) 12.6(1) ES3 (Available) Cisco Contact Center Management Portal (CCMP) CSCwa47383 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47383"] 12.5(1) ES6 (Available) 12.6(1) ES3 (Available) Cisco Emergency Responder CSCwa47391 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47391"] 11.5(4)SU9 patch (16 Dec 2021) 11.5(4)SU10 patch (16 Dec 2021) Cisco Enterprise Chat and Email CSCwa47392 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47392"] 12.0(1) patch (Available) 12.5 (1) patch (Available) 12.6(1) patch (Available) Cisco Finesse CSCwa46459 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa46459"] 12.6(1)ES03 (23 Dec 2021) Cisco Packaged Contact Center Enterprise CSCwa47274 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47274"] 11.6(2) (Available) 12.0(1) (Available) 12.5(1) (Available) 12.6(1) (Available) Cisco Paging Server CSCwa47395 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47395"] 14.4.2 (21 Dec 2021) Cisco Unified Communications Manager / Cisco Unified Communications Manager Session Management Edition CSCwa47249 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47249"] 11.5(1)SU7 patch (16 Dec 2021) 11.5(1)SU8 patch (16 Dec 2021) 11.5(1)SU9 patch (16 Dec 2021) 11.5(1)SU10 patch (16 Dec 2021) 11.5(1.18119-2) through 11.5(1.23162-1) patch (16 Dec 2021) Cisco Unified Communications Manager IM &Presence Service CSCwa47393 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47393"] 11.5(1)SU7 patch (16 Dec 2021) 11.5(1)SU8 patch (16 Dec 2021) 11.5(1)SU9 patch (16 Dec 2021) 11.5(1)SU10 patch (16 Dec 2021) 11.5(1.18900-16) patch (16 Dec 2021) 11.5(1.18901-3) patch (16 Dec 2021) Cisco Unified Contact Center Enterprise - Live Data server CSCwa46810 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa46810"] 11.6(1)ES23 (23 Dec 2021) 12.0(1)ES18 (23 Dec 2021) 12.5(1)ES13 (23 Dec 2021) 12.6(1)ES03 (23 Dec 2021) Cisco Unified Contact Center Enterprise CSCwa47273 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47273"] 11.6(2) (Available) 12.0(1) (Available) 12.5(1) (Available) 12.6(1) (Available) Cisco Unified Contact Center Express CSCwa47388 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47388"] 12.5(1)SU1 (23 Dec 2021) Cisco Unified Customer Voice Portal CSCwa47275 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47275"] 11.6(2) (Available) 12.0(1) (Available) 12.5(1) (Available) 12.6(1) (23 Dec 2021) Cisco Unified Intelligence Center CSCwa46525 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa46525"] 12.6(1) (23 Dec 2021) Cisco Unified SIP Proxy Software CSCwa47265 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47265"] 10.2.1v2 patch (23 Dec 2021) Cisco Unity Connection CSCwa47387 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47387"] 11.5(1)SU7 patch (16 Dec 2021) 11.5(1)SU8 patch (16 Dec 2021) 11.5(1)SU9 patch (16 Dec 2021) 11.5(1)SU10 patch (16 Dec 2021) 11.5(1.18119-2) through 11.5(1.23162-1) patch (16 Dec 2021) Cisco Virtualized Voice Browser CSCwa47397 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47397"] 12.5(1) (Available) 12.6(1) (23 Dec 2021) Cisco Webex Workforce Optimization CSCwa51476 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa51476"] Product is End of Software Maintenance - No Fixes Planned Video, Streaming, TelePresence, and Transcoding Devices Cisco Video Surveillance Operations Manager CSCwa47360 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47360"] 7.14.4 patch (Available) Cisco Vision Dynamic Signage Director CSCwa47351 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47351"] Contact Cisco TAC for a patch 6.4 SP3 (17 Jan 2021) Wireless Cisco Connected Mobile Experiences (CMX) CSCwa47312 ["https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47312"] 10.6.3-70 patch (Available) 10.6.3-105 patch (Available) 10.6.2-89 patch (Available) 10.4.1 patch (Available)
Products Confirmed Not Vulnerable
Cisco investigated its product line to determine which products may be affected by these vulnerabilities. Any product not listed in the Products Under Investigation or Vulnerable Products section of this advisory is to be considered not vulnerable. Cisco has confirmed that these vulnerabilities do not affect the following Cisco products: Cable Devices Cisco GS7000 Nodes Cisco RF Gateway Series Cisco Remote PHY 120 Collaboration and Social Media Cisco SocialMiner Endpoint Clients and Client Software Cisco AnyConnect Secure Mobility Client Cisco Jabber Guest Cisco Jabber Cisco Secure Endpoint, formerly Cisco Advanced Malware Protection for Endpoints Cisco Webex App Meraki Products Cisco Meraki Go Series Cisco Meraki MR Series Cloud-Managed Wireless Access Points Cisco Meraki MS Series Switches Cisco Meraki MT Series Sensors Cisco Meraki MV Series Cloud-Managed Smart Cameras Cisco Meraki MX Series Cloud-Managed Security and SD-WAN Cisco Meraki Systems Manager (SM) Cisco Meraki Z-Series Cloud-Managed Teleworker Gateway Network Application, Service, and Acceleration Cisco Cloud Services Platform 2100 Cisco Cloud Services Platform 5000 Series Cisco Nexus Dashboard Data Broker Cisco Tetration Analytics Cisco Wide Area Application Services (WAAS) ConfD Network and Content Security Devices Cisco AMP Virtual Private Cloud Appliance Cisco Adaptive Security Appliance (ASA) Software Cisco Adaptive Security Device Manager Cisco Adaptive Security Virtual Appliance (ASAv) Cisco Advanced Web Security Reporting Application Cisco Email Security Appliance (ESA) Cisco FXOS Firepower Chassis Manager Cisco Firepower Management Center Cisco Firepower Next-Generation Intrusion Prevention System (NGIPS) Cisco Firepower Threat Defense (FTD) managed by Cisco Firepower Management Center Cisco Secure Email Encryption Add-in Cisco Secure Email Encryption Plugin for Outlook Cisco Secure Email Security Plugin for Outlook Cisco Secure Email and Web Manager, formerly Cisco Content Security Management Appliance (SMA) Cisco Secure Network Analytics, formerly Stealthwatch Enterprise, Advanced Host Group Automation (AHGA) Cisco Secure Network Analytics, formerly Stealthwatch Enterprise, Flow Adapter Cisco Secure Network Analytics, formerly Stealthwatch Enterprise, Network Forensics Automation (NFA) Cisco Secure Network Analytics, formerly Stealthwatch Enterprise, Proxy Adapter Cisco Secure Network Analytics, formerly Stealthwatch Cisco Secure Services Proxy (CSSP) Cisco Security Malware Analytics Appliance, formerly Cisco Threat Grid Appliance Cisco Security Manager Cisco Web Security Appliance (WSA) Network Management and Provisioning Cisco ACI Multi-Site Orchestrator Cisco CloudCenter Action Orchestrator Cisco Connected Grid Device Manager Cisco Container Platform Cisco Crosswork Change Automation Cisco Crosswork Health Insights Cisco Crosswork Service Health Cisco Elastic Services Controller (ESC) Cisco Intelligent Node (iNode) Manager Cisco Intersight Mobile App Cisco IoT Field Network Director, formerly Cisco Connected Grid Network Management System Cisco Modeling Labs Cisco NCS 2000 Shelf Virtualization Orchestrator Cisco Optical Network Planner Cisco Policy Suite Cisco Prime Access Registrar Cisco Prime Cable Provisioning Cisco Prime Central for Service Providers Cisco Prime Collaboration Assurance Cisco Prime Collaboration Deployment Cisco Prime Collaboration Provisioning Cisco Prime IP Express Cisco Prime Infrastructure Cisco Prime License Manager Cisco Prime Network Registrar Cisco Prime Network Cisco Prime Optical for Service Providers Cisco Prime Performance Manager Cisco Prime Provisioning Cisco Process Orchestrator Cisco Smart Software Manager On-Prem Cisco Telemetry Broker Routing and Switching - Enterprise and Service Provider Cisco ACI Virtual Edge Cisco ASR 5000 Series Routers Cisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM) Cisco Enterprise NFV Infrastructure Software (NFVIS) Cisco GGSN Gateway GPRS Support Node Cisco IOS XR Software Cisco IOS and IOS XE Software Cisco IP Services Gateway (IPSG) Cisco MDS 9000 Series Multilayer Switches Cisco MME Mobility Management Entity Cisco Mobility Unified Reporting and Analytics System Cisco Network Convergence System 2000 Series Cisco Nexus 3000 Series Switches Cisco Nexus 5500 Platform Switches Cisco Nexus 5600 Platform Switches Cisco Nexus 6000 Series Switches Cisco Nexus 7000 Series Switches Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode Cisco Nexus 9000 Series Switches in standalone NX-OS mode Cisco ONS 15454 Series Multiservice Provisioning Platforms Cisco PDSN/HA Packet Data Serving Node and Home Agent Cisco PGW Packet Data Network Gateway Cisco SD-WAN vBond Controller Software Cisco SD-WAN vEdge 100 Series Routers Cisco SD-WAN vEdge 1000 Series Routers Cisco SD-WAN vEdge 2000 Series Routers Cisco SD-WAN vEdge 5000 Series Routers Cisco SD-WAN vEdge Cloud Router Platform Cisco SD-WAN vSmart Controller Software Cisco System Architecture Evolution Gateway (SAEGW) Cisco Ultra Cloud Core - Access and Mobility Management Function Cisco Ultra Cloud Core - Policy Control Function Cisco Ultra Cloud Core - Redundancy Configuration Manager Cisco Ultra Cloud Core - Session Management Function Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure Cisco Ultra Packet Core Cisco Ultra Services Platform Routing and Switching - Small Business Cisco 220 Series Smart Plus Switches Cisco 250 Series Smart Switches Cisco 350 Series Managed Switches Cisco 550 Series Stackable Managed Switches Cisco Business 220 Series Smart Switches Cisco Business 250 Series Smart Switches Cisco Business 350 Series Managed Switches Cisco Business Dashboard Cisco RV110W Wireless-N VPN Firewall Cisco RV130 VPN Router Cisco RV130W Wireless-N Multifunction VPN Router Cisco RV132W ADSL2+ Wireless-N VPN Router Cisco RV134W VDSL2 Wireless-AC VPN Router Cisco RV160 VPN Router Cisco RV160W Wireless-AC VPN Router Cisco RV215W Wireless-N VPN Router Cisco RV260 VPN Routers Cisco RV260P VPN Router with PoE Cisco RV260W Wireless-AC VPN Router Cisco RV320 Dual Gigabit WAN VPN Router Cisco RV325 Dual Gigabit WAN VPN Router Cisco RV340 Dual WAN Gigabit VPN Router Cisco RV340W Dual WAN Gigabit Wireless-AC VPN Router Cisco RV345 Dual WAN Gigabit VPN Router Cisco RV345P Dual WAN Gigabit POE VPN Router Cisco Small Business 200 Series Smart Switches Cisco Small Business 300 Series Managed Switches Cisco Small Business 500 Series Stackable Managed Switches Cisco WAP125 Wireless-AC Dual Band Desktop Access Point with PoE Cisco WAP150 Wireless-AC/N Dual Radio Access Point with PoE Cisco WAP361 Wireless-AC/N Dual Radio Wall Plate Access Point with PoE Cisco WAP371 Wireless-AC/N Radio Access Point with Single Point Setup Cisco WAP571 Wireless-AC/N Premium Dual Radio Access Point with PoE Cisco WAP571E Wireless-AC/N Premium Dual Radio Outdoor Access Point Cisco WAP581 Wireless-AC Dual Radio Wave 2 Access Point with 2.5GbE LAN Unified Computing Cisco 5000 Series Enterprise Network Compute System (ENCS) Cisco HyperFlex System Cisco Hyperflex Storage Replication Adapter Cisco UCS C-Series Rack Servers and S-Series Storage Servers - Integrated Management Controller (CIMC) Cisco UCS E-Series Servers Cisco UCS Manager Voice and Unified Communications Devices Cisco Headset 500 and 700 Series Cisco Hosted Collaboration Mediation Fulfillment Cisco IP Phones with Multiplatform Firmware Cisco IP Phones Cisco TelePresence Endpoints Cisco Unified Attendant Console Advanced Cisco Unified Attendant Console Business Edition Cisco Unified Attendant Console Department Edition Cisco Unified Attendant Console Enterprise Edition Cisco Unified Attendant Console Premium Edition Cisco Unified Communications Domain Manager Cisco Unity Express Cisco Webex Devices Cisco Webex Hybrid Data Security Node Cisco Webex Video Mesh Video, Streaming, TelePresence, and Transcoding Devices Cisco Expressway Series Cisco Meeting Management (CMM) Cisco Meeting Server Cisco TelePresence Management Suite Cisco TelePresence Video Communication Server (VCS) Cisco Video Surveillance Media Server Wireless Cisco AireOS Wireless LAN Controllers Cisco Aironet Access Points Cisco Business 100 and 200 Series Access Points Cisco Business Wireless Cisco Catalyst 9100 Series Access Points Cisco Catalyst 9800 Series Wireless Controllers Cisco IOS Access Points Cisco Mobility Services Engine Cisco Ultra-Reliable Wireless Backhaul Cisco Cloud Offerings Cisco investigated its cloud offerings to determine which products may be affected by these vulnerabilities. The following table lists Cisco cloud offerings that were part of this investigation. Product CVE-2021-44228 CVE-2021-45046 AppDynamics Remediated - service-specific details ["https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability"] Remediated - service-specific details ["https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability"] AppDynamics with Cisco Secure Application Remediated - service-specific details ["https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability"] Remediated - service-specific details ["https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability"] Cisco Cloud Email Security Not vulnerable Not vulnerable Cisco Cloudlock Remediated Remediated Cisco Cloudlock for Government Remediated Remediated Cisco Cognitive Intelligence Not vulnerable Not vulnerable Cisco Collaboration Experience Service (CES) Not vulnerable Not vulnerable Cisco Collaboration Experience Service Management (CESM) Not vulnerable Not vulnerable Cisco Crosswork Cloud Not vulnerable Not vulnerable Cisco CX Cloud Remediated Remediated Cisco Defense Orchestrator Not vulnerable Not vulnerable Cisco DNA Spaces Remediated Remediated Cisco Intersight Remediated Remediated Cisco IoT Control Center Remediated Remediated Cisco IoT Operations Dashboard Remediated Remediated Cisco Kinetic for Cities Remediated Remediated Cisco Kinetic Gateway Management Module Remediated Remediated Cisco Managed Services Accelerator (MSX) Remediated Remediated Cisco Placetel Not vulnerable Not vulnerable Cisco PX Cloud Remediated Remediated Cisco SD-WAN Cloud Remediated Remediated Cisco SD-WAN vAnalytics Not vulnerable Not vulnerable Cisco Secure Application (integrated with AppDynamics) Not vulnerable ["https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability"] Not vulnerable ["https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability"] Cisco Secure Cloud Analytics, formerly Cisco Stealthwatch Cloud Not vulnerable Not vulnerable Cisco Secure Cloud Insights Not vulnerable Not vulnerable Cisco Secure Email Cloud Mailbox, formerly Cisco Cloud Mailbox Defense Not vulnerable Not vulnerable Cisco Secure Email Encryption Service, formerly Cisco Registered Envelope Service Not vulnerable Not vulnerable Cisco Secure Endpoint, formerly Cisco Advanced Malware Protection for Endpoints Not vulnerable Not vulnerable Cisco Secure Malware Analytics, formerly Cisco Threat Grid Not vulnerable Not vulnerable Cisco SecureX Not vulnerable Not vulnerable Cisco ServiceGrid Not vulnerable Not vulnerable Cisco Smart Net Total Care Remediated Remediated Cisco Umbrella DNS Remediated Remediated Cisco Umbrella SIG Remediated Remediated Cisco Unified Communications Management Cloud - UC Management Remediated Remediated Cisco Unified Communications Manager Cloud Commercial Remediated Remediated Cisco Unified Communications Manager Cloud for Government Remediated Remediated Cisco Webex Calling Remediated Remediated Cisco Webex Calling Carrier Remediated Remediated Cisco Webex Cloud Registered Endpoints Not vulnerable Not vulnerable Cisco Webex Cloud-Connected UC Remediated Remediated Cisco Webex Contact Center Remediated Remediated Cisco Webex Contact Center Enterprise Remediated Remediated Cisco Webex Control Hub Remediated Remediated Cisco Webex Experience Management Not vulnerable Not vulnerable Cisco Webex FedRAMP Remediated Remediated Cisco Webex for Government FedRAMP Remediated Remediated Cisco Webex Meetings Remediated Remediated Cisco Webex Meetings Slow Channel Remediated Remediated Cisco Webex Messaging Remediated Remediated Cisco Webex Site Admin webpage Remediated Remediated Duo Security Remediated Remediated Duo Security for Government Remediated Remediated eSIM Flex Remediated Remediated IMIassist Not vulnerable Not vulnerable IMIcampaign Not vulnerable Not vulnerable IMIconnect Remediated Remediated IMIengage Not vulnerable Not vulnerable IMImessenger/TextLocal Messenger Not vulnerable Not vulnerable IMImobile - Webex Contact Center Integration Remediated Remediated IMInotify Not vulnerable Not vulnerable IMIsocial Not vulnerable Not vulnerable Kenna.AppSec Remediated Remediated Kenna.VI/VI+ Remediated Remediated Kenna.VM Remediated Remediated Meraki Not vulnerable Not vulnerable Partner Supporting Service(PSS) Remediated Remediated Slido Not vulnerable Not vulnerable Smart Call Home(SCH) Remediated Remediated Socio Not vulnerable Not vulnerable ThousandEyes Remediated Remediated UC-One - UMS Not vulnerable Not vulnerable
Workarounds
Any workarounds are documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products ["#vp"] section of this advisory.
Fixed Software
For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products ["#vp"] section of this advisory. When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Vulnerability Policy
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy ["https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
Exploitation and Public Announcements
The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerabilities described in this advisory.
Source
These vulnerabilities were disclosed by the Apache Software Foundation.
Legal Disclaimer
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.



{
  "document": {
    "acknowledgments": [
      {
        "summary": "These vulnerabilities were disclosed by the Apache Software Foundation."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "summary",
        "text": "Critical Vulnerabilities in Apache Log4j Java Logging Library\r\n\r\nOn December 9, 2021, the following critical vulnerability in the Apache Log4j Java logging library affecting all Log4j2 versions earlier than 2.15.0 was disclosed:\r\n\r\nCVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints\r\n\r\nOn December 14, 2021, the following critical vulnerability, which affects certain Apache Log4j use cases in versions 2.15.0 and earlier, was disclosed:\r\n\r\nCVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack\r\n\r\nOn December 18, 2021, a vulnerability in the Apache Log4j component affecting versions 2.16 and earlier was disclosed:\r\n\r\nCVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation\r\n\r\nOn December 28, 2021, a vulnerability in the Apache Log4j component affecting versions 2.17 and earlier was disclosed:\r\n\r\nCVE-2021-44832: Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration\r\n\r\nFor a description of these vulnerabilities, see the Apache Log4j Security Vulnerabilities [\"https://logging.apache.org/log4j/2.x/security.html\"] page.\r\n\r\nCisco\u0027s Response to These Vulnerabilities\r\n\r\nCisco assessed all products and services for impact from both CVE-2021-44228 and CVE-2021-45046. To help detect exploitation of these vulnerabilities, Cisco has released Snort rules at the following location: Talos Rules 2021-12-21 [\"https://www.snort.org/advisories/talos-rules-2021-12-21\"]\r\n\r\nProduct fixes that are listed in this advisory will address both CVE-2021-44228 and CVE-2021-45046 unless otherwise noted.\r\n\r\nCisco has reviewed CVE-2021-45105 and CVE-2021-44832 and has determined that no Cisco products or cloud offerings are impacted by these vulnerabilities.\r\n\r\nCisco\u0027s standard practice is to update integrated third-party software components to later versions as they become available.\r\n\r\nThis advisory is available at the following link:\r\nhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd [\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd\"]",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Cisco investigated its product line to determine which products may be affected by these vulnerabilities.\r\n\r\nThis advisory only lists Cisco products and services that are known to include the impacted software component and thus may be vulnerable. Products and services that do not contain the impacted software component are not vulnerable and therefore are not listed in this advisory. Any Cisco product or service that is not explicitly listed in the Affected Products section of this advisory is not affected by the vulnerability or vulnerabilities described.\r\n\r\nThe Vulnerable Products [\"#vp\"] section includes Cisco bug IDs for each affected product. The bugs are accessible through the Cisco Bug Search Tool and contain additional platform-specific information, including workarounds (if available) and fixed software releases.",
        "title": "Affected Products"
      },
      {
        "category": "general",
        "text": "Cisco investigated its product line to determine which products may be affected by these vulnerabilities.\r\n\r\nThe following table lists Cisco products that are affected by one or both of the vulnerabilities that are described in this advisory. Customers should refer to the associated Cisco bug(s) for further details.\r\n        Product  Cisco Bug ID  Fixed Release Availability [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes\"]      Collaboration and Social Media      Cisco Webex Meetings Server  CSCwa47283 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47283\"]  CWMS-3.0MR4SP3 patch (21 Dec 2021)\r\nCWMS-4.0MR4SP3 patch (21 Dec 2021)\r\nCWMS-3.0MR4SP2 patch (14 Dec 2021)\r\nCWMS-4.0MR4SP2 patch (14 Dec 2021)      Endpoint Clients and Client Software      Cisco CX Cloud Agent Software  CSCwa47272 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47272\"]  1.12.2 (17 Dec 2021)      Network Application, Service, and Acceleration      Cisco Call Studio  CSCwa54008 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa54008\"]  11.6(2) (23 Dec 2021)\r\n12.0(1) (23 Dec 2021)\r\n12.5(1) (23 Dec 2021)\r\n12.6(1) (23 Dec 2021)      Cisco Nexus Insights  CSCwa47284 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47284\"]  6.0.2 (17 Dec 2021)      Network and Content Security Devices      Cisco Firepower Threat Defense (FTD) managed by Firepower Device Manager (FDM)  CSCwa46963 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa46963\"]  6.2.3 hotfix (Available)\r\n6.4.0 hotfix (Available)\r\n6.6.5 hotfix (Available)\r\n6.7.0 hotfix (Available)\r\n7.0.1 hotfix (Available)\r\n7.1.0 hotfix (Available)      Cisco Identity Services Engine (ISE)  CSCwa47133 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47133\"]  2.4 hotfix (15 Dec 2021)\r\n2.6 hotfix (15 Dec 2021)\r\n2.7 hotfix (15 Dec 2021)\r\n3.0 hotfix (15 Dec 2021)\r\n3.1 hotfix (17 Dec 2021)      Network Management and Provisioning      Cisco Application Policy Infrastructure Controller (APIC) - Network Insights Base App  CSCwa47295 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47295\"]  4.2(7r) (Available)\r\n5.2(3g) (Available)      Cisco Automated Subsea Tuning  CSCwa48806 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa48806\"]  2.1.0.4 (22 Dec 2021)      Cisco Business Process Automation  CSCwa47269 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47269\"]  3.0.000.115 (patch) (17 Dec 2021)\r\n3.1.000.044 (patch) (17 Dec 2021)\r\n3.2.000.009 (patch) (17 Dec 2021)      Cisco CloudCenter Cost Optimizer  CSCwa48074 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa48074\"]  5.5.2 (Available)      Cisco CloudCenter Suite Admin  CSCwa47349 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47349\"]  5.3.1 (Available)      Cisco CloudCenter Workload Manager  CSCwa47350 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47350\"]  5.5.2 (Available)      Cisco CloudCenter  CSCwa48832 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa48832\"]  4.10.0.16 (22 Dec 2021)      Cisco Common Services Platform Collector (CSPC)  CSCwa47271 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47271\"]  2.10.0.1 hotfix (Available)\r\n2.9.1.3 hotfix (Available)      Cisco Crosswork Data Gateway  CSCwa47257 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47257\"]  2.0.2 patch (21 Dec 2021)\r\n3.0.1 patch (21 Dec 2021)      Cisco Crosswork Network Controller  CSCwa49936 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa49936\"]  2.0.1 patch (22 Dec 2021)\r\n3.0.1 patch (22 Dec 2021)      Cisco Crosswork Optimization Engine  CSCwa49939 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa49939\"]  2.0.1 patch (21 Dec 2021)\r\n3.0.1 patch (21 Dec 2021)      Cisco Crosswork Platform Infrastructure  CSCwa47367 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47367\"]  4.0.1 patch (22 Dec 2021)\r\n4.1.1 patch (22 Dec 2021)      Cisco Crosswork Situation Manager  CSCwa51878 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa51878\"]  8.0.0.8 patch (21 Dec 2021)      Cisco Crosswork Zero Touch Provisioning (ZTP)  CSCwa47259 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47259\"]  2.0.1 patch (21 Dec 2021)\r\n3.0.1 patch (21 Dec 2021)      Cisco Cyber Vision Sensor Management Extension  CSCwa49482 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa49482\"]  4.0.3 (22 Dec 2021)      Cisco DNA Spaces Connector  CSCwa47320 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47320\"]  v2.0.588 (Available)\r\nv2.2.12 (Available)      Cisco Data Center Network Manager (DCNM)  CSCwa47291 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47291\"]  12.0(2f) (Available)\r\n11.5(3) patch (Available)\r\n11.5(2) patch (Available)\r\n11.5(1) patch (Available)\r\n11.4(1) patch (Available)\r\n11.3(1) patch (Available)      Cisco Evolved Programmable Network Manager  CSCwa47310 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47310\"]  5.1.3.1 patch (22 Dec 2021)\r\n5.0.2.1 patch (13 Jan 2022)\r\n4.1.1.1 patch (13 Jan 2022)      Cisco Intersight Virtual Appliance  CSCwa47304 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47304\"]  1.0.9-361 (20 Dec 2021)      Cisco Network Services Orchestrator (NSO)  CSCwa47342 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47342\"]  nso-5.3.5.1 (17 Dec 2021)\r\nnso-5.4.5.2 (17 Dec 2021)\r\nnso-5.5.4.1 (17 Dec 2021)\r\nnso-5.6.3.1 (17 Dec 2021)      Cisco Nexus Dashboard, formerly Cisco Application Services Engine  CSCwa47299 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47299\"]  2.1.2 (23 Dec 2021)      Cisco Prime Service Catalog  CSCwa47347 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47347\"]  12.1 patch (20 Dec 2021)      Cisco Secure Agile Exchange (SAE) Core Function Pack  CSCwa52921 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa52921\"]  2.4.1 (14 Jan 2022)      Cisco Smart PHY  CSCwa50021 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa50021\"]  3.1.4 patch (Available)\r\n3.2.0 patch (Available)\r\n3.2.1 patch (Available)\r\n21.3 patch (21 Jan 2022)      Cisco Virtual Topology System (VTS)  CSCwa47334 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47334\"]  2.6.7 (22 Dec 2021)      Cisco Virtualized Infrastructure Manager  CSCwa49924 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa49924\"]  3.2.x patch (17 Dec 2021)\r\n3.4.4 patch (17 Dec 2021)\r\n3.4.6 patch (17 Dec 2021)\r\n4.2.0 patch (17 Dec 2021)\r\n4.2.1 patch (17 Dec 2021)      Cisco WAN Automation Engine (WAE)  CSCwa47369 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47369\"]  7.5.0.1 (22 Dec 2021)\r\n7.4.0.1 (28 Jan 2022)\r\n7.3.0.2 (28 Jan 2022)      Routing and Switching - Enterprise and Service Provider      Cisco DNA Center  CSCwa47322 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47322\"]  2.2.2.8 patch (Available)\r\n2.1.2.8 patch (Available)\r\n2.2.3.4 patch (Available)      Cisco IOx Fog Director  CSCwa47370 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47370\"]  1.14.5 patch (16 Dec 2021)\r\n1.16.4 patch (Available)      Cisco Network Assurance Engine  CSCwa47285 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47285\"]  6.0.2 (23 Dec 2021)      Cisco Network Convergence System 1004  CSCwa52235 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa52235\"]  7.3.2 SMU/GISO (14 Jan 2022)\r\n7.3.1 SMU (21 Jan 2022)      Cisco Optical Network Controller  CSCwa48793 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa48793\"]  1.1.0 (22 Dec 2021)      Cisco SD-WAN vManage  CSCwa47745 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47745\"]  20.3.4.1 (Available)\r\n20.6.2.1 (Available)\r\n20.5.1.1 (Available)\r\n20.4.2.1 (Available)      Unified Computing      Cisco Integrated Management Controller (IMC) Supervisor  CSCwa47307 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47307\"]  2.3.2.1 (23 Dec 2021)      Cisco UCS Central Software  CSCwa47303 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47303\"]  2.0(1p) (22 Dec 2021)      Cisco UCS Director  CSCwa47288 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47288\"]  6.8.2.0 (23 Dec 2021)      Cisco Workload Optimization Manager  CSCwa50220 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa50220\"]  3.2.1 patch (Available)      Voice and Unified Communications Devices      Cisco BroadWorks  CSCwa47315 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47315\"]  2021.11_1.162 (13 Dec 2021)\r\nap381882 (15 Dec 2021)      Cisco Cloud Connect  CSCwa51545 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa51545\"]  12.6(1) (Available)      Cisco Contact Center Domain Manager (CCDM)  CSCwa47383 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47383\"]  12.5(1) ES6 (Available)\r\n12.6(1) ES3 (Available)      Cisco Contact Center Management Portal (CCMP)  CSCwa47383 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47383\"]  12.5(1) ES6 (Available)\r\n12.6(1) ES3 (Available)      Cisco Emergency Responder  CSCwa47391 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47391\"]  11.5(4)SU9 patch (16 Dec 2021)\r\n11.5(4)SU10 patch (16 Dec 2021)      Cisco Enterprise Chat and Email  CSCwa47392 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47392\"]  12.0(1) patch (Available)\r\n12.5 (1) patch (Available)\r\n12.6(1) patch (Available)      Cisco Finesse  CSCwa46459 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa46459\"]  12.6(1)ES03 (23 Dec 2021)      Cisco Packaged Contact Center Enterprise  CSCwa47274 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47274\"]  11.6(2) (Available)\r\n12.0(1) (Available)\r\n12.5(1) (Available)\r\n12.6(1) (Available)      Cisco Paging Server  CSCwa47395 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47395\"]  14.4.2 (21 Dec 2021)      Cisco Unified Communications Manager / Cisco Unified Communications Manager Session Management Edition  CSCwa47249 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47249\"]  11.5(1)SU7 patch (16 Dec 2021)\r\n11.5(1)SU8 patch (16 Dec 2021)\r\n11.5(1)SU9 patch (16 Dec 2021)\r\n11.5(1)SU10 patch (16 Dec 2021)\r\n11.5(1.18119-2) through 11.5(1.23162-1) patch (16 Dec 2021)      Cisco Unified Communications Manager IM \u0026Presence Service  CSCwa47393 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47393\"]  11.5(1)SU7 patch (16 Dec 2021)\r\n11.5(1)SU8 patch (16 Dec 2021)\r\n11.5(1)SU9 patch (16 Dec 2021)\r\n11.5(1)SU10 patch (16 Dec 2021)\r\n11.5(1.18900-16) patch (16 Dec 2021)\r\n11.5(1.18901-3) patch (16 Dec 2021)      Cisco Unified Contact Center Enterprise - Live Data server  CSCwa46810 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa46810\"]  11.6(1)ES23 (23 Dec 2021)\r\n12.0(1)ES18 (23 Dec 2021)\r\n12.5(1)ES13 (23 Dec 2021)\r\n12.6(1)ES03 (23 Dec 2021)      Cisco Unified Contact Center Enterprise  CSCwa47273 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47273\"]  11.6(2) (Available)\r\n12.0(1) (Available)\r\n12.5(1) (Available)\r\n12.6(1) (Available)      Cisco Unified Contact Center Express  CSCwa47388 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47388\"]  12.5(1)SU1 (23 Dec 2021)      Cisco Unified Customer Voice Portal  CSCwa47275 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47275\"]  11.6(2) (Available)\r\n12.0(1) (Available)\r\n12.5(1) (Available)\r\n12.6(1) (23 Dec 2021)      Cisco Unified Intelligence Center  CSCwa46525 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa46525\"]  12.6(1) (23 Dec 2021)      Cisco Unified SIP Proxy Software  CSCwa47265 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47265\"]  10.2.1v2 patch (23 Dec 2021)      Cisco Unity Connection  CSCwa47387 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47387\"]  11.5(1)SU7 patch (16 Dec 2021)\r\n11.5(1)SU8 patch (16 Dec 2021)\r\n11.5(1)SU9 patch (16 Dec 2021)\r\n11.5(1)SU10 patch (16 Dec 2021)\r\n11.5(1.18119-2) through 11.5(1.23162-1) patch (16 Dec 2021)      Cisco Virtualized Voice Browser  CSCwa47397 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47397\"]  12.5(1) (Available)\r\n12.6(1) (23 Dec 2021)      Cisco Webex Workforce Optimization  CSCwa51476 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa51476\"]  Product is End of Software Maintenance - No Fixes Planned      Video, Streaming, TelePresence, and Transcoding Devices      Cisco Video Surveillance Operations Manager  CSCwa47360 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47360\"]  7.14.4 patch (Available)      Cisco Vision Dynamic Signage Director  CSCwa47351 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47351\"]  Contact Cisco TAC for a patch\r\n6.4 SP3 (17 Jan 2021)      Wireless      Cisco Connected Mobile Experiences (CMX)  CSCwa47312 [\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47312\"]  10.6.3-70 patch (Available)\r\n10.6.3-105 patch (Available)\r\n10.6.2-89 patch (Available)\r\n10.4.1 patch (Available)",
        "title": "Vulnerable Products"
      },
      {
        "category": "general",
        "text": "Cisco investigated its product line to determine which products may be affected by these vulnerabilities.\r\n\r\nAny product not listed in the Products Under Investigation or Vulnerable Products section of this advisory is to be considered not vulnerable.\r\n\r\nCisco has confirmed that these vulnerabilities do not affect the following Cisco products:\r\n\r\nCable Devices\r\n\r\nCisco GS7000 Nodes\r\nCisco RF Gateway Series\r\nCisco Remote PHY 120\r\n\r\nCollaboration and Social Media\r\n\r\nCisco SocialMiner\r\n\r\nEndpoint Clients and Client Software\r\n\r\nCisco AnyConnect Secure Mobility Client\r\nCisco Jabber Guest\r\nCisco Jabber\r\nCisco Secure Endpoint, formerly Cisco Advanced Malware Protection for Endpoints\r\nCisco Webex App\r\n\r\nMeraki Products\r\n\r\nCisco Meraki Go Series\r\nCisco Meraki MR Series Cloud-Managed Wireless Access Points\r\nCisco Meraki MS Series Switches\r\nCisco Meraki MT Series Sensors\r\nCisco Meraki MV Series Cloud-Managed Smart Cameras\r\nCisco Meraki MX Series Cloud-Managed Security and SD-WAN\r\nCisco Meraki Systems Manager (SM)\r\nCisco Meraki Z-Series Cloud-Managed Teleworker Gateway\r\n\r\nNetwork Application, Service, and Acceleration\r\n\r\nCisco Cloud Services Platform 2100\r\nCisco Cloud Services Platform 5000 Series\r\nCisco Nexus Dashboard Data Broker\r\nCisco Tetration Analytics\r\nCisco Wide Area Application Services (WAAS)\r\nConfD\r\n\r\nNetwork and Content Security Devices\r\n\r\nCisco AMP Virtual Private Cloud Appliance\r\nCisco Adaptive Security Appliance (ASA) Software\r\nCisco Adaptive Security Device Manager\r\nCisco Adaptive Security Virtual Appliance (ASAv)\r\nCisco Advanced Web Security Reporting Application\r\nCisco Email Security Appliance (ESA)\r\nCisco FXOS Firepower Chassis Manager\r\nCisco Firepower Management Center\r\nCisco Firepower Next-Generation Intrusion Prevention System (NGIPS)\r\nCisco Firepower Threat Defense (FTD) managed by Cisco Firepower Management Center\r\nCisco Secure Email Encryption Add-in\r\nCisco Secure Email Encryption Plugin for Outlook\r\nCisco Secure Email Security Plugin for Outlook\r\nCisco Secure Email and Web Manager, formerly Cisco Content Security Management Appliance (SMA)\r\nCisco Secure Network Analytics, formerly Stealthwatch Enterprise, Advanced Host Group Automation (AHGA)\r\nCisco Secure Network Analytics, formerly Stealthwatch Enterprise, Flow Adapter\r\nCisco Secure Network Analytics, formerly Stealthwatch Enterprise, Network Forensics Automation (NFA)\r\nCisco Secure Network Analytics, formerly Stealthwatch Enterprise, Proxy Adapter\r\nCisco Secure Network Analytics, formerly Stealthwatch\r\nCisco Secure Services Proxy (CSSP)\r\nCisco Security Malware Analytics Appliance, formerly Cisco Threat Grid Appliance\r\nCisco Security Manager\r\nCisco Web Security Appliance (WSA)\r\n\r\nNetwork Management and Provisioning\r\n\r\nCisco ACI Multi-Site Orchestrator\r\nCisco CloudCenter Action Orchestrator\r\nCisco Connected Grid Device Manager\r\nCisco Container Platform\r\nCisco Crosswork Change Automation\r\nCisco Crosswork Health Insights\r\nCisco Crosswork Service Health\r\nCisco Elastic Services Controller (ESC)\r\nCisco Intelligent Node (iNode) Manager\r\nCisco Intersight Mobile App\r\nCisco IoT Field Network Director, formerly Cisco Connected Grid Network Management System\r\nCisco Modeling Labs\r\nCisco NCS 2000 Shelf Virtualization Orchestrator\r\nCisco Optical Network Planner\r\nCisco Policy Suite\r\nCisco Prime Access Registrar\r\nCisco Prime Cable Provisioning\r\nCisco Prime Central for Service Providers\r\nCisco Prime Collaboration Assurance\r\nCisco Prime Collaboration Deployment\r\nCisco Prime Collaboration Provisioning\r\nCisco Prime IP Express\r\nCisco Prime Infrastructure\r\nCisco Prime License Manager\r\nCisco Prime Network Registrar\r\nCisco Prime Network\r\nCisco Prime Optical for Service Providers\r\nCisco Prime Performance Manager\r\nCisco Prime Provisioning\r\nCisco Process Orchestrator\r\nCisco Smart Software Manager On-Prem\r\nCisco Telemetry Broker\r\n\r\nRouting and Switching - Enterprise and Service Provider\r\n\r\nCisco ACI Virtual Edge\r\nCisco ASR 5000 Series Routers\r\nCisco Application Policy Infrastructure Controller Enterprise Module (APIC-EM)\r\nCisco Enterprise NFV Infrastructure Software (NFVIS)\r\nCisco GGSN Gateway GPRS Support Node\r\nCisco IOS XR Software\r\nCisco IOS and IOS XE Software\r\nCisco IP Services Gateway (IPSG)\r\nCisco MDS 9000 Series Multilayer Switches\r\nCisco MME Mobility Management Entity\r\nCisco Mobility Unified Reporting and Analytics System\r\nCisco Network Convergence System 2000 Series\r\nCisco Nexus 3000 Series Switches\r\nCisco Nexus 5500 Platform Switches\r\nCisco Nexus 5600 Platform Switches\r\nCisco Nexus 6000 Series Switches\r\nCisco Nexus 7000 Series Switches\r\nCisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode\r\nCisco Nexus 9000 Series Switches in standalone NX-OS mode\r\nCisco ONS 15454 Series Multiservice Provisioning Platforms\r\nCisco PDSN/HA Packet Data Serving Node and Home Agent\r\nCisco PGW Packet Data Network Gateway\r\nCisco SD-WAN vBond Controller Software\r\nCisco SD-WAN vEdge 100 Series Routers\r\nCisco SD-WAN vEdge 1000 Series Routers\r\nCisco SD-WAN vEdge 2000 Series Routers\r\nCisco SD-WAN vEdge 5000 Series Routers\r\nCisco SD-WAN vEdge Cloud Router Platform\r\nCisco SD-WAN vSmart Controller Software\r\nCisco System Architecture Evolution Gateway (SAEGW)\r\nCisco Ultra Cloud Core - Access and Mobility Management Function\r\nCisco Ultra Cloud Core - Policy Control Function\r\nCisco Ultra Cloud Core - Redundancy Configuration Manager\r\nCisco Ultra Cloud Core - Session Management Function\r\nCisco Ultra Cloud Core - Subscriber Microservices Infrastructure\r\nCisco Ultra Packet Core\r\nCisco Ultra Services Platform\r\n\r\nRouting and Switching - Small Business\r\n\r\nCisco 220 Series Smart Plus Switches\r\nCisco 250 Series Smart Switches\r\nCisco 350 Series Managed Switches\r\nCisco 550 Series Stackable Managed Switches\r\nCisco Business 220 Series Smart Switches\r\nCisco Business 250 Series Smart Switches\r\nCisco Business 350 Series Managed Switches\r\nCisco Business Dashboard\r\nCisco RV110W Wireless-N VPN Firewall\r\nCisco RV130 VPN Router\r\nCisco RV130W Wireless-N Multifunction VPN Router\r\nCisco RV132W ADSL2+ Wireless-N VPN Router\r\nCisco RV134W VDSL2 Wireless-AC VPN Router\r\nCisco RV160 VPN Router\r\nCisco RV160W Wireless-AC VPN Router\r\nCisco RV215W Wireless-N VPN Router\r\nCisco RV260 VPN Routers\r\nCisco RV260P VPN Router with PoE\r\nCisco RV260W Wireless-AC VPN Router\r\nCisco RV320 Dual Gigabit WAN VPN Router\r\nCisco RV325 Dual Gigabit WAN VPN Router\r\nCisco RV340 Dual WAN Gigabit VPN Router\r\nCisco RV340W Dual WAN Gigabit Wireless-AC VPN Router\r\nCisco RV345 Dual WAN Gigabit VPN Router\r\nCisco RV345P Dual WAN Gigabit POE VPN Router\r\nCisco Small Business 200 Series Smart Switches\r\nCisco Small Business 300 Series Managed Switches\r\nCisco Small Business 500 Series Stackable Managed Switches\r\nCisco WAP125 Wireless-AC Dual Band Desktop Access Point with PoE\r\nCisco WAP150 Wireless-AC/N Dual Radio Access Point with PoE\r\nCisco WAP361 Wireless-AC/N Dual Radio Wall Plate Access Point with PoE\r\nCisco WAP371 Wireless-AC/N Radio Access Point with Single Point Setup\r\nCisco WAP571 Wireless-AC/N Premium Dual Radio Access Point with PoE\r\nCisco WAP571E Wireless-AC/N Premium Dual Radio Outdoor Access Point\r\nCisco WAP581 Wireless-AC Dual Radio Wave 2 Access Point with 2.5GbE LAN\r\n\r\nUnified Computing\r\n\r\nCisco 5000 Series Enterprise Network Compute System (ENCS)\r\nCisco HyperFlex System\r\nCisco Hyperflex Storage Replication Adapter\r\nCisco UCS C-Series Rack Servers and S-Series Storage Servers - Integrated Management Controller (CIMC)\r\nCisco UCS E-Series Servers\r\nCisco UCS Manager\r\n\r\nVoice and Unified Communications Devices\r\n\r\nCisco Headset 500 and 700 Series\r\nCisco Hosted Collaboration Mediation Fulfillment\r\nCisco IP Phones with Multiplatform Firmware\r\nCisco IP Phones\r\nCisco TelePresence Endpoints\r\nCisco Unified Attendant Console Advanced\r\nCisco Unified Attendant Console Business Edition\r\nCisco Unified Attendant Console Department Edition\r\nCisco Unified Attendant Console Enterprise Edition\r\nCisco Unified Attendant Console Premium Edition\r\nCisco Unified Communications Domain Manager\r\nCisco Unity Express\r\nCisco Webex Devices\r\nCisco Webex Hybrid Data Security Node\r\nCisco Webex Video Mesh\r\n\r\nVideo, Streaming, TelePresence, and Transcoding Devices\r\n\r\nCisco Expressway Series\r\nCisco Meeting Management (CMM)\r\nCisco Meeting Server\r\nCisco TelePresence Management Suite\r\nCisco TelePresence Video Communication Server (VCS)\r\nCisco Video Surveillance Media Server\r\n\r\nWireless\r\n\r\nCisco AireOS Wireless LAN Controllers\r\nCisco Aironet Access Points\r\nCisco Business 100 and 200 Series Access Points\r\nCisco Business Wireless\r\nCisco Catalyst 9100 Series Access Points\r\nCisco Catalyst 9800 Series Wireless Controllers\r\nCisco IOS Access Points\r\nCisco Mobility Services Engine\r\nCisco Ultra-Reliable Wireless Backhaul\r\n     Cisco Cloud Offerings\r\nCisco investigated its cloud offerings to determine which products may be affected by these vulnerabilities. The following table lists Cisco cloud offerings that were part of this investigation.\r\n\r\n        Product  CVE-2021-44228  CVE-2021-45046      AppDynamics  Remediated - service-specific details [\"https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability\"]  Remediated - service-specific details [\"https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability\"]      AppDynamics with Cisco Secure Application  Remediated - service-specific details [\"https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability\"]  Remediated - service-specific details [\"https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability\"]      Cisco Cloud Email Security  Not vulnerable  Not vulnerable      Cisco Cloudlock  Remediated  Remediated      Cisco Cloudlock for Government  Remediated  Remediated      Cisco Cognitive Intelligence  Not vulnerable  Not vulnerable      Cisco Collaboration Experience Service (CES)  Not vulnerable  Not vulnerable      Cisco Collaboration Experience Service Management (CESM)  Not vulnerable  Not vulnerable      Cisco Crosswork Cloud  Not vulnerable  Not vulnerable      Cisco CX Cloud  Remediated  Remediated      Cisco Defense Orchestrator  Not vulnerable  Not vulnerable      Cisco DNA Spaces  Remediated  Remediated      Cisco Intersight  Remediated  Remediated      Cisco IoT Control Center  Remediated  Remediated      Cisco IoT Operations Dashboard  Remediated  Remediated      Cisco Kinetic for Cities  Remediated  Remediated      Cisco Kinetic Gateway Management Module  Remediated  Remediated      Cisco Managed Services Accelerator (MSX)  Remediated  Remediated      Cisco Placetel  Not vulnerable  Not vulnerable      Cisco PX Cloud  Remediated  Remediated      Cisco SD-WAN Cloud  Remediated  Remediated      Cisco SD-WAN vAnalytics  Not vulnerable  Not vulnerable      Cisco Secure Application (integrated with AppDynamics)  Not vulnerable [\"https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability\"]  Not vulnerable [\"https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability\"]      Cisco Secure Cloud Analytics, formerly Cisco Stealthwatch Cloud  Not vulnerable  Not vulnerable      Cisco Secure Cloud Insights  Not vulnerable  Not vulnerable      Cisco Secure Email Cloud Mailbox, formerly Cisco Cloud Mailbox Defense  Not vulnerable  Not vulnerable      Cisco Secure Email Encryption Service, formerly Cisco Registered Envelope Service  Not vulnerable  Not vulnerable      Cisco Secure Endpoint, formerly Cisco Advanced Malware Protection for Endpoints  Not vulnerable  Not vulnerable      Cisco Secure Malware Analytics, formerly Cisco Threat Grid  Not vulnerable  Not vulnerable      Cisco SecureX  Not vulnerable  Not vulnerable      Cisco ServiceGrid  Not vulnerable  Not vulnerable      Cisco Smart Net Total Care  Remediated  Remediated      Cisco Umbrella DNS  Remediated  Remediated      Cisco Umbrella SIG  Remediated  Remediated      Cisco Unified Communications Management Cloud - UC Management  Remediated  Remediated      Cisco Unified Communications Manager Cloud Commercial  Remediated  Remediated      Cisco Unified Communications Manager Cloud for Government  Remediated  Remediated      Cisco Webex Calling  Remediated  Remediated      Cisco Webex Calling Carrier  Remediated  Remediated      Cisco Webex Cloud Registered Endpoints  Not vulnerable  Not vulnerable      Cisco Webex Cloud-Connected UC  Remediated  Remediated      Cisco Webex Contact Center  Remediated  Remediated      Cisco Webex Contact Center Enterprise  Remediated  Remediated      Cisco Webex Control Hub  Remediated  Remediated      Cisco Webex Experience Management  Not vulnerable  Not vulnerable      Cisco Webex FedRAMP  Remediated  Remediated      Cisco Webex for Government FedRAMP  Remediated  Remediated      Cisco Webex Meetings  Remediated  Remediated      Cisco Webex Meetings Slow Channel  Remediated  Remediated      Cisco Webex Messaging  Remediated  Remediated      Cisco Webex Site Admin webpage  Remediated  Remediated      Duo Security  Remediated  Remediated      Duo Security for Government  Remediated  Remediated      eSIM Flex  Remediated  Remediated      IMIassist  Not vulnerable  Not vulnerable      IMIcampaign  Not vulnerable  Not vulnerable      IMIconnect  Remediated  Remediated      IMIengage  Not vulnerable  Not vulnerable      IMImessenger/TextLocal Messenger  Not vulnerable  Not vulnerable      IMImobile - Webex Contact Center Integration  Remediated  Remediated      IMInotify  Not vulnerable  Not vulnerable      IMIsocial  Not vulnerable  Not vulnerable      Kenna.AppSec  Remediated  Remediated      Kenna.VI/VI+  Remediated  Remediated      Kenna.VM  Remediated  Remediated      Meraki  Not vulnerable  Not vulnerable      Partner Supporting Service(PSS)  Remediated  Remediated      Slido  Not vulnerable  Not vulnerable      Smart Call Home(SCH)  Remediated  Remediated      Socio  Not vulnerable  Not vulnerable      ThousandEyes  Remediated  Remediated      UC-One - UMS  Not vulnerable  Not vulnerable",
        "title": "Products Confirmed Not Vulnerable"
      },
      {
        "category": "general",
        "text": "Any workarounds are documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products [\"#vp\"] section of this advisory.",
        "title": "Workarounds"
      },
      {
        "category": "general",
        "text": "For information about fixed software releases, consult the Cisco bugs identified in the Vulnerable Products [\"#vp\"] section of this advisory.\r\n\r\nWhen considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.\r\n\r\nIn all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.",
        "title": "Fixed Software"
      },
      {
        "category": "general",
        "text": "To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy [\"https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html\"]. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.",
        "title": "Vulnerability Policy"
      },
      {
        "category": "general",
        "text": "The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerabilities described in this advisory.",
        "title": "Exploitation and Public Announcements"
      },
      {
        "category": "general",
        "text": "These vulnerabilities were disclosed by the Apache Software Foundation.",
        "title": "Source"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS DOCUMENT IS PROVIDED ON AN \"AS IS\" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.\r\n\r\nA standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.",
        "title": "Legal Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "Emergency Support:\r\n+1 877 228 7302 (toll-free within North America)\r\n+1 408 525 6532 (International direct-dial)\r\nNon-emergency Support:\r\nEmail: psirt@cisco.com\r\nSupport requests that are received via e-mail are typically acknowledged within 48 hours.",
      "issuing_authority": "Cisco product security incident response is the responsibility of the Cisco Product Security Incident Response Team (PSIRT). The Cisco PSIRT is a dedicated, global team that manages the receipt, investigation, and public reporting of security vulnerability information that is related to Cisco products and networks. The on-call Cisco PSIRT works 24x7 with Cisco customers, independent security researchers, consultants, industry organizations, and other vendors to identify possible security issues with Cisco products and networks.\r\nMore information can be found in Cisco Security Vulnerability Policy available at https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html",
      "name": "Cisco",
      "namespace": "https://wwww.cisco.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"
      },
      {
        "category": "external",
        "summary": "Cisco Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      },
      {
        "category": "external",
        "summary": "Apache Log4j Security Vulnerabilities",
        "url": "https://logging.apache.org/log4j/2.x/security.html"
      },
      {
        "category": "external",
        "summary": "Talos Rules 2021-12-21",
        "url": "https://www.snort.org/advisories/talos-rules-2021-12-21"
      },
      {
        "category": "external",
        "summary": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd",
        "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"
      },
      {
        "category": "external",
        "summary": "Fixed Release Availability",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html#fixes"
      },
      {
        "category": "external",
        "summary": "CSCwa47283",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47283"
      },
      {
        "category": "external",
        "summary": "CSCwa47272",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47272"
      },
      {
        "category": "external",
        "summary": "CSCwa54008",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa54008"
      },
      {
        "category": "external",
        "summary": "CSCwa47284",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47284"
      },
      {
        "category": "external",
        "summary": "CSCwa46963",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa46963"
      },
      {
        "category": "external",
        "summary": "CSCwa47133",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47133"
      },
      {
        "category": "external",
        "summary": "CSCwa47295",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47295"
      },
      {
        "category": "external",
        "summary": "CSCwa48806",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa48806"
      },
      {
        "category": "external",
        "summary": "CSCwa47269",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47269"
      },
      {
        "category": "external",
        "summary": "CSCwa48074",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa48074"
      },
      {
        "category": "external",
        "summary": "CSCwa47349",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47349"
      },
      {
        "category": "external",
        "summary": "CSCwa47350",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47350"
      },
      {
        "category": "external",
        "summary": "CSCwa48832",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa48832"
      },
      {
        "category": "external",
        "summary": "CSCwa47271",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47271"
      },
      {
        "category": "external",
        "summary": "CSCwa47257",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47257"
      },
      {
        "category": "external",
        "summary": "CSCwa49936",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa49936"
      },
      {
        "category": "external",
        "summary": "CSCwa49939",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa49939"
      },
      {
        "category": "external",
        "summary": "CSCwa47367",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47367"
      },
      {
        "category": "external",
        "summary": "CSCwa51878",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa51878"
      },
      {
        "category": "external",
        "summary": "CSCwa47259",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47259"
      },
      {
        "category": "external",
        "summary": "CSCwa49482",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa49482"
      },
      {
        "category": "external",
        "summary": "CSCwa47320",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47320"
      },
      {
        "category": "external",
        "summary": "CSCwa47291",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47291"
      },
      {
        "category": "external",
        "summary": "CSCwa47310",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47310"
      },
      {
        "category": "external",
        "summary": "CSCwa47304",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47304"
      },
      {
        "category": "external",
        "summary": "CSCwa47342",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47342"
      },
      {
        "category": "external",
        "summary": "CSCwa47299",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47299"
      },
      {
        "category": "external",
        "summary": "CSCwa47347",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47347"
      },
      {
        "category": "external",
        "summary": "CSCwa52921",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa52921"
      },
      {
        "category": "external",
        "summary": "CSCwa50021",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa50021"
      },
      {
        "category": "external",
        "summary": "CSCwa47334",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47334"
      },
      {
        "category": "external",
        "summary": "CSCwa49924",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa49924"
      },
      {
        "category": "external",
        "summary": "CSCwa47369",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47369"
      },
      {
        "category": "external",
        "summary": "CSCwa47322",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47322"
      },
      {
        "category": "external",
        "summary": "CSCwa47370",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47370"
      },
      {
        "category": "external",
        "summary": "CSCwa47285",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47285"
      },
      {
        "category": "external",
        "summary": "CSCwa52235",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa52235"
      },
      {
        "category": "external",
        "summary": "CSCwa48793",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa48793"
      },
      {
        "category": "external",
        "summary": "CSCwa47745",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47745"
      },
      {
        "category": "external",
        "summary": "CSCwa47307",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47307"
      },
      {
        "category": "external",
        "summary": "CSCwa47303",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47303"
      },
      {
        "category": "external",
        "summary": "CSCwa47288",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47288"
      },
      {
        "category": "external",
        "summary": "CSCwa50220",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa50220"
      },
      {
        "category": "external",
        "summary": "CSCwa47315",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47315"
      },
      {
        "category": "external",
        "summary": "CSCwa51545",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa51545"
      },
      {
        "category": "external",
        "summary": "CSCwa47383",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47383"
      },
      {
        "category": "external",
        "summary": "CSCwa47383",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47383"
      },
      {
        "category": "external",
        "summary": "CSCwa47391",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47391"
      },
      {
        "category": "external",
        "summary": "CSCwa47392",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47392"
      },
      {
        "category": "external",
        "summary": "CSCwa46459",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa46459"
      },
      {
        "category": "external",
        "summary": "CSCwa47274",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47274"
      },
      {
        "category": "external",
        "summary": "CSCwa47395",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47395"
      },
      {
        "category": "external",
        "summary": "CSCwa47249",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47249"
      },
      {
        "category": "external",
        "summary": "CSCwa47393",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47393"
      },
      {
        "category": "external",
        "summary": "CSCwa46810",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa46810"
      },
      {
        "category": "external",
        "summary": "CSCwa47273",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47273"
      },
      {
        "category": "external",
        "summary": "CSCwa47388",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47388"
      },
      {
        "category": "external",
        "summary": "CSCwa47275",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47275"
      },
      {
        "category": "external",
        "summary": "CSCwa46525",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa46525"
      },
      {
        "category": "external",
        "summary": "CSCwa47265",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47265"
      },
      {
        "category": "external",
        "summary": "CSCwa47387",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47387"
      },
      {
        "category": "external",
        "summary": "CSCwa47397",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47397"
      },
      {
        "category": "external",
        "summary": "CSCwa51476",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa51476"
      },
      {
        "category": "external",
        "summary": "CSCwa47360",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47360"
      },
      {
        "category": "external",
        "summary": "CSCwa47351",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47351"
      },
      {
        "category": "external",
        "summary": "CSCwa47312",
        "url": "https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa47312"
      },
      {
        "category": "external",
        "summary": "Remediated - service-specific details",
        "url": "https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability"
      },
      {
        "category": "external",
        "summary": "Remediated - service-specific details",
        "url": "https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability"
      },
      {
        "category": "external",
        "summary": "Remediated - service-specific details",
        "url": "https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability"
      },
      {
        "category": "external",
        "summary": "Remediated - service-specific details",
        "url": "https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability"
      },
      {
        "category": "external",
        "summary": "Not vulnerable",
        "url": "https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability"
      },
      {
        "category": "external",
        "summary": "Not vulnerable",
        "url": "https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability"
      },
      {
        "category": "external",
        "summary": "Security Vulnerability Policy",
        "url": "https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html"
      }
    ],
    "title": "Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021",
    "tracking": {
      "current_release_date": "2022-01-31T21:16:10+00:00",
      "generator": {
        "date": "2022-10-22T03:14:00+00:00",
        "engine": {
          "name": "TVCE"
        }
      },
      "id": "cisco-sa-apache-log4j-qRuKNEbd",
      "initial_release_date": "2021-12-10T18:45:00+00:00",
      "revision_history": [
        {
          "date": "2021-12-10T18:49:19+00:00",
          "number": "1.0.0",
          "summary": "Initial public release."
        },
        {
          "date": "2021-12-10T20:58:15+00:00",
          "number": "1.1.0",
          "summary": "Added Snort rule link."
        },
        {
          "date": "2021-12-11T00:58:43+00:00",
          "number": "1.2.0",
          "summary": "Added Products Under Investigation."
        },
        {
          "date": "2021-12-11T19:15:38+00:00",
          "number": "1.3.0",
          "summary": "Indicated advisory update schedule. Updated the vulnerable products and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-11T23:12:24+00:00",
          "number": "1.4.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-12T15:01:39+00:00",
          "number": "1.5.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-12T18:11:59+00:00",
          "number": "1.6.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-12T19:02:40+00:00",
          "number": "1.7.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-12T23:05:52+00:00",
          "number": "1.8.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-13T15:31:38+00:00",
          "number": "1.9.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-13T20:34:26+00:00",
          "number": "1.10.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-13T23:43:56+00:00",
          "number": "1.11.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-14T15:42:33+00:00",
          "number": "1.12.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-14T19:36:34+00:00",
          "number": "1.13.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-14T23:57:07+00:00",
          "number": "1.14.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-15T15:08:09+00:00",
          "number": "1.15.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-15T19:27:33+00:00",
          "number": "1.16.0",
          "summary": "Updated the summary, products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-15T23:51:35+00:00",
          "number": "1.17.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-16T15:22:33+00:00",
          "number": "1.18.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-16T19:07:05+00:00",
          "number": "1.19.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-16T23:12:10+00:00",
          "number": "1.20.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-17T19:02:40+00:00",
          "number": "1.21.0",
          "summary": "Updated the summary, products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-18T00:07:30+00:00",
          "number": "1.22.0",
          "summary": "Updated the products under investigation, vulnerable products, and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-19T16:29:55+00:00",
          "number": "1.23.0",
          "summary": "Updated summary and products under investigation."
        },
        {
          "date": "2021-12-20T20:29:03+00:00",
          "number": "1.24.0",
          "summary": "Updated vulnerable products and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-21T20:55:00+00:00",
          "number": "1.25.0",
          "summary": "Updated vulnerable products and products confirmed not vulnerable."
        },
        {
          "date": "2021-12-22T20:47:44+00:00",
          "number": "1.26.0",
          "summary": "Updated vulnerable products and products confirmed not vulnerable. Updated the summary to indicate that no Cisco products are affected by CVE-2021-45105."
        },
        {
          "date": "2021-12-22T22:58:15+00:00",
          "number": "1.27.0",
          "summary": "Updated vulnerable products."
        },
        {
          "date": "2022-01-06T23:16:04+00:00",
          "number": "1.28.0",
          "summary": "Updated summary and vulnerable products."
        },
        {
          "date": "2022-01-07T18:00:53+00:00",
          "number": "1.29.0",
          "summary": "Updated vulnerable products."
        },
        {
          "date": "2022-01-10T18:01:02+00:00",
          "number": "1.30.0",
          "summary": "Updated vulnerable products."
        },
        {
          "date": "2022-01-11T20:28:32+00:00",
          "number": "1.31.0",
          "summary": "Updated products confirmed not vulnerable."
        },
        {
          "date": "2022-01-31T21:16:10+00:00",
          "number": "1.32.0",
          "summary": "Updated vulnerable products."
        }
      ],
      "status": "final",
      "version": "1.32.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_family",
            "name": "Cisco Unified Communications Manager IM and Presence Service",
            "product": {
              "name": "Cisco Unified Communications Manager IM and Presence Service ",
              "product_id": "CSAFPID-189784"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Evolved Programmable Network Manager (EPNM)",
            "product": {
              "name": "Cisco Evolved Programmable Network Manager (EPNM) ",
              "product_id": "CSAFPID-213688"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Network Services Orchestrator",
            "product": {
              "name": "Cisco Network Services Orchestrator ",
              "product_id": "CSAFPID-227765"
            }
          },
          {
            "category": "product_family",
            "name": "Cisco Unified Communications Manager / Cisco Unity Connection",
            "product": {
              "name": "Cisco Unified Communications Manager / Cisco Unity Connection ",
              "product_id": "CSAFPID-277610"
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44832",
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-213688",
          "CSAFPID-227765",
          "CSAFPID-277610",
          "CSAFPID-189784"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-277610",
            "CSAFPID-213688",
            "CSAFPID-227765",
            "CSAFPID-189784"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-213688",
            "CSAFPID-227765",
            "CSAFPID-277610",
            "CSAFPID-189784"
          ]
        }
      ],
      "title": "vuln-CVE-2021-44832"
    },
    {
      "cve": "CVE-2021-45046",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa47310"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa56230"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-227765",
          "CSAFPID-277610",
          "CSAFPID-213688",
          "CSAFPID-189784"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-277610",
            "CSAFPID-213688",
            "CSAFPID-227765",
            "CSAFPID-189784"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-227765",
            "CSAFPID-277610",
            "CSAFPID-213688",
            "CSAFPID-189784"
          ]
        }
      ],
      "title": "vuln-CVE-2021-45046"
    },
    {
      "cve": "CVE-2021-44228",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa56230"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-277610",
          "CSAFPID-189784"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-277610",
            "CSAFPID-189784"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-277610",
            "CSAFPID-189784"
          ]
        }
      ],
      "title": "Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021"
    },
    {
      "cve": "CVE-2021-45105",
      "ids": [
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa56230"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa54650"
        },
        {
          "system_name": "Cisco Bug ID",
          "text": "CSCwa47310"
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "Complete.",
          "title": "Affected Product Comprehensiveness"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-189784",
          "CSAFPID-213688"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Cisco has released software updates that address this vulnerability.",
          "product_ids": [
            "CSAFPID-213688",
            "CSAFPID-189784"
          ],
          "url": "https://software.cisco.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-189784",
            "CSAFPID-213688"
          ]
        }
      ],
      "title": "Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021 (CVE-2021-45105)"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading...

Loading...

Loading...

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.