topic Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma in Network Access Control

Cisco ISE hot patch log4j -CSCwa47133 - File not the correct format

seto_wai_hong — Thu, 16 Dec 2021 10:12:34 GMT

Cisco Identity Services Engine Software hot patch for the log4j PSIRT bug - CSCwa47133. Apply this hot patch for 2.4,2.6,2.7 and 3.0 patches.

Patch cannot installed. patch file is not in the correct format.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

Mike.Cifelli — Thu, 16 Dec 2021 13:45:04 GMT

See here: CSCwa47133 - Evaluation log4j CVE-2021-44228 - Cisco Community

Specifically @Leo Laohoo post

HTH!

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

csavoy — Thu, 16 Dec 2021 14:11:28 GMT

Same problem with message "% Unable to unbundle the package. It should be in tar.gz file format"

But the downloaded file is only 20kB big... it looks very small for a patch...

Could it be a "fake" file used to prepare the release of the real hot fix ???

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

bearman97 — Thu, 16 Dec 2021 14:45:41 GMT

My download was only 5K. Did your download get ungzipped?

Haven't tried to install yet, waiting to see what others' experiences are.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

Mike.Cifelli — Thu, 16 Dec 2021 15:22:22 GMT

See the shared link above from another post. Specifically @Leo Laohoo 's post. There is a readme link that breaks the process down. Lastly, yes an application restart is required.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

Marcelo Morais — Thu, 16 Dec 2021 15:39:57 GMT

Hi @seto_wai_hong ,

please take a look at the following post: ISE 2.7.0.356.

Hope this helps !!!

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

MatthewShaw4644 — Thu, 16 Dec 2021 22:01:21 GMT

I got it to work by running it from a local repo instead of the usual SFTP repo. No idea why that would matter but it did the trick for me. ISE 2.4.0.357

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

Arne Bier — Fri, 17 Dec 2021 03:26:34 GMT

I was able to install the patch on ISE 2.7 patch 6 using an FTP repo.

It applied just fine and after applications auto-restarted, all was good.

Interestingly, you can't easily see whether the hotfix is installed (show ver, show application or looking in the Patch Management GUI etc.)

I found it under show version history at the bottom of the output:

nac1/admin# show ver history
---------------------------------------------
Install Date: Tue Nov 30 00:07:03 UTC 2021
Application: ise
Version: 2.7.0.356
Install type: Application Install
Bundle filename: ise.tar.gz
Repository: SystemDefaultPkgRepos
---------------------------------------------
Install Date: Wed Dec  1 07:57:58 AEST 2021
Application: ise
Version: 6
Install type: Patch Install
Bundle filename: ise-patchbundle-2.7.0.356-Patch6-21110108.SPA.x86_64.tar.gz
Repository: tmplocalpatchinstallrepo
---------------------------------------------
Install Date: Fri Dec 17 13:16:17 AEST 2021
Application: Apply_CSCwa47133_all_common_1
Version: 1
Install type: Application Install
Bundle filename: ise-apply-CSCwa47133_Ver_24_30_allpatches-SPA.tar.gz
Repository: AD-01
---------------------------------------------
Install Date: Fri Dec 17 13:17:00 AEST 2021
Application: Apply_CSCwa47133_all_common_1
Version: 1
Install type: Application Remove
nac1/admin#

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

csavoy — Fri, 17 Dec 2021 07:26:55 GMT

I downloaded the file once again a few hours later and the size changed to 5kB.

I was able to install it with no error message.. I don't know why my first file was 20kB big...

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

gmasters428 — Fri, 17 Dec 2021 15:59:40 GMT

A bit odd you can't install this patch via GUI due to the "incorrect file format" error.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

Damien Miller — Fri, 17 Dec 2021 16:14:30 GMT

This happened to my customer too. I downloaded the file again via Chrome, then copied it with Filezilla ftp portable. Not sure how they ended up with a 20k file, but it prompted me to overwrite indicating the size discrepancy.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

seto_wai_hong — Mon, 20 Dec 2021 03:42:50 GMT

% Warning: Patch will be installed only on this node. Install using Primary Administration node GUI to install on all nodes in deployment. Continue? (yes/no) [yes] ? yes
Save the current ADE-OS running configuration? (yes/no) [yes] ? yes
Generating configuration...
Saved the ADE-OS running configuration to startup successfully
Initiating Application Patch installation...

Getting bundle to local machine...
Unbundling Application Package...
Verifying Application Signature...
% Error: Application bundle detected. Please use application CLI for application installation or upgrade.

I get the error - % Error: Application bundle detected. Please use application CLI for application installation or upgrade.

Help Any one? Tks.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

Greg Gibbs — Mon, 20 Dec 2021 04:04:22 GMT

From the error output you're seeing, it looks like you're trying to install using the 'patch install' CLI command. You need to use the 'application install' command as stated in the Release Notes for this hot patch.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

Naresh Ginjupalli — Mon, 20 Dec 2021 05:32:45 GMT

This is known behaviour with Chrome Browser. Please use firefox or any other browser.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

Naresh Ginjupalli — Mon, 20 Dec 2021 05:37:22 GMT

Release notes has all the details of installation and how to check the same.

=================================================
README for installing Hot Patch to fix CSCwa47133 
=================================================

This hot patch is to address CSCwa47133 (related to Apache Log4j2)

Download the following files from CCO.
                                                               
ise-apply-CSCwa47133_Ver_24_30_allpatches-SPA.tar.gz 
ise-rollback-CSCwa47133_Ver_24_30_allpatches-SPA.tar.gz 


Confirm that the hash of the downloaded files matches the ones listed on CCO.
Copy the files to repository which is reachable from ISE.
Configure the repository in ISE to start the installation process.

===================
Few important notes
===================

This is a generic fix and it can be installed on top of any patch of ISE 2.4, 2.6, 2.7 or 3.0 

This needs to be installed on every ISE node in a deployment.

===============
How to install 
===============

Login to ISE CLI
Invoke the following command to install the bundle which will apply the hot patch:

"application install ise-apply-CSCwa47133_Ver_24_30_allpatches-SPA.tar.gz <REPOSITORY_NAME>" 

=======================================================
How to Verify whether patch has installed successfully
=======================================================

Login to ISE CLI
Execute the command "show logging application hotpatch.log"
"CSCwa47133_all_common_1 => CSCwa47133" should be displayed. This confirms the hot patch is successfully installed.


===============
How to Rollback 
===============

(Note: This is only required if you need to remove the hot patch)

Login to ISE CLI
Invoke the following command to rollback the hot patch:

"application install ise-rollback-CSCwa47133_Ver_24_30_allpatches-SPA.tar.gz  <REPOSITORY_NAME>"

There is a different file for ISE 3.1 release.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

Naresh Ginjupalli — Mon, 20 Dec 2021 05:47:24 GMT

Hot patch can only be installed from ISE CLI . The GUI install support for Hot patch is not yet available . The incorrect file format could be because of browser behavior while downloading the file from Cisco site. If you are using Chrome please try firefox and see if you are still encountering the issue.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

michaeldodd98 — Mon, 20 Dec 2021 22:40:09 GMT

I had the exact same issue had to open a TAC case. My file was also 20kb. Same error. I also used FileZIlla. I redownloaded and used MacOS native FTP text based client, set to BIN format for the transfer, and lo and behold it was 5kb and installed fine.

The way you know you have a problem is if the file is 20kb also the MD5 hash will NOT match what is on Cisco's release notes/download page.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

tim.mcdonald — Tue, 21 Dec 2021 04:09:58 GMT

I tried installing with the GUI from Firefox and did not have any success. I received the unsupported format message also.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

Naresh Ginjupalli — Tue, 21 Dec 2021 04:25:58 GMT

Installing Hotpatch from GUI is not supported. Hot patch has to be installed only from CLI using the commands mentioned in Hotpatch release notes.

Re: Cisco ISE hot patch log4j -CSCwa47133 - File not the correct forma

rpidcock@bankrcb.net — Tue, 21 Dec 2021 21:00:51 GMT

Is it required to run this patch on both nodes if I have a secondary node, or do I just run it on my primary node?