topic Re: CSCwa47133 - ISE 3.1 - Log4j Patch Availability? in Network Access Control

CSCwa47133 - ISE 3.1 - Log4j Patch Availability?

pkarelis — Thu, 16 Dec 2021 19:37:07 GMT

ISE 3.1 ( 3.001(000.518) a/k/a 3.1.0.518) is listed as vulnerable, and the current patch that is available is showing for ISE 2.4-3.0. When will an ISE 3.1 patch become available?

Also, a public service announcement: the 3.0 patch doesn't work on ISE 3.1 in case you get impatient like me.

I attempted to install 2.4-3.0 patch on ISE 3.1, and the install worked, but ISE wouldn't start after the install with the following error:

PAN01/admin# application start ise
% Error: ISE Integrity Check Failed! One or more ISE program files appears to
%        be tampered with. Check system log for specific error(s).
% Application failed to start

ISE Started without issue after rollback of the patch.

Re: CSCwa47133 - ISE 3.1 - Log4j Patch Availability?

Arne Bier — Thu, 16 Dec 2021 21:46:19 GMT

In fairness to Cisco, they did say that the patch was for ISE 2.4 through 3.0 - perhaps it's already fixed in ISE 3.1? Or they have not yet got around to fixing it. Or perhaps ISE 3.1 doesn't use this Apache library? Who knows.

Nice try though 🙂

Re: CSCwa47133 - ISE 3.1 - Log4j Patch Availability?

Leo Laohoo — Thu, 16 Dec 2021 23:14:49 GMT

~~Raise a TAC Case.~~

Latest update to the Vulnerabilities in Apache Log4j Library Affecting Cisco Products security bulletin (update 1.19) has stated hotfix for ISE 3.1 to be available on 17 December 2021.

Re: CSCwa47133 - ISE 3.1 - Log4j Patch Availability?

rpmoyer93 — Fri, 17 Dec 2021 21:33:40 GMT

Getting pretty late in the day for the east coast here for a release of the patch for 3.1. Is this still expected today or should we be watching over the weekend?

Re: CSCwa47133 - ISE 3.1 - Log4j Patch Availability?

Leo Laohoo — Sat, 18 Dec 2021 00:31:05 GMT

@rpmoyer93 wrote:

Getting pretty late in the day for the east coast here for a release of the patch for 3.1. Is this still expected today or should we be watching over the weekend?

ISE 3.1 Patch 1 is now available and can be found HERE.

ISE 3.1 Patch 1 Release Notes can be found HERE.

NOTE: Applying ISE 3.1 Patch 1 will restart the services.

Re: CSCwa47133 - ISE 3.1 - Log4j Patch Availability?

Thompso75401 — Mon, 27 Dec 2021 13:56:32 GMT

What order should I use to patch my ise deployment w/ the log4j fix. Admin nodes, then mnt, then psn, etc...?

Re: CSCwa47133 - ISE 3.1 - Log4j Patch Availability?

Mark Elsen — Mon, 27 Dec 2021 16:11:50 GMT

- The order is not important , and or also check this thread :

https://community.cisco.com/t5/network-access-control/log4j-hotfix-cscwa47133-ise-distributed-environment/m-p/4521609#M571847