topic Re: Fixing Struts2 CVE-2017-5638 in Network Access Control

Fixing Struts2 CVE-2017-5638

llinddahl — Fri, 21 Feb 2020 18:34:59 GMT

According to relese notes the struts fix apply to ISE 2.1 patch 3

How is it with ISE 2.1 patch 5 should we appy the struts fix also to patch 5 ?

From release notes

Download the latest patch available from CCO and install before installing these bundles.
please note that this patch should be installed only on top of latest patch (Not hotfixes).

2.0 Patch 4
2.0.1 Patch 3
2.1 Patch 3
2.2 ( No patches )

Kind regards

Lars-Ove

Re: Fixing Struts2 CVE-2017-5638

Rahul Govindan — Wed, 27 Sep 2017 13:07:29 GMT

I believe the patch is already integrated with 2.1 Patch 4 and above. So if you are using 2.1 patch 5, you do not need to install the patch separately.

Re: Fixing Struts2 CVE-2017-5638

Marvin Rhoads — Wed, 27 Sep 2017 13:39:45 GMT

Confirming what Rahul said - ISE 2.1 Patch 4 resolved the struts vulnerability so any 2.1 system with that patch (or later) does not require the Struts hotfix. (ISE patches are cumulative.)