ISE 2.2 patch 12 - Apache Struts Vulnerability

chbudima — Tue, 08 Jan 2019 01:07:17 GMT

Hi Team,

We have ISE 2.2 patch 9 with Apache Struts Hotpatch "ise-apply-CSCvm14030_2.2.0.470_common_1-SPA.tar.gz" installed. The Apache Struts hotpatch was installed from CCO download page to fix Apache Struts vulnerability CVE-2018-11776 back in August 2018.

We need to install ISE 2.2 patch 12 to fix the latest Apache Struts vulnerability CVE-2016-1000031 which announced on Nov 2018.

My query is how to install ISE 2.2 patch 12 in this situation:

Do we need to rollback Apache Struts Hotpatch "ise-apply-CSCvm14030_2.2.0.470_common_1-SPA.tar.gz" first before installing 2.2 patch 12?

Or do we directly install 2.2 patch 12 without uninstall Apache Struts Hotpatch first on top ofISE 2.2 patch 9 with Apache Struts Hotpatch "ise-apply-CSCvm14030_2.2.0.470_common_1-SPA.tar.gz" ?

Could you please advise ?

Thanks for your help.

Regards,

Charles

Re: ISE 2.2 patch 12 - Apache Struts Vulnerability

Jason Kunst — Tue, 08 Jan 2019 15:35:30 GMT

Per the TAC and development team, rollback is recommended. There will be no further guidance on this for now

Re: ISE 2.2 patch 12 - Apache Struts Vulnerability

chbudima — Tue, 08 Jan 2019 21:12:53 GMT

Thanks Jason for your recommendation.

Regards,

Charles

topic Re: ISE 2.2 patch 12 - Apache Struts Vulnerability in Network Access Control

ISE 2.2 patch 12 - Apache Struts Vulnerability

Re: ISE 2.2 patch 12 - Apache Struts Vulnerability

Re: ISE 2.2 patch 12 - Apache Struts Vulnerability