topic Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l in Wireless

Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or later

SIT Network Support — Wed, 15 Jun 2022 02:18:45 GMT

We want to check currently our Cisco Prime running on Apache 2.4.50 (there is some Multiple Vulnerabilities) and want to know if there Apache version 2.4.53 or later.

Please do provide us the work around on this as well

Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l

Flavio Miranda — Wed, 15 Jun 2022 02:56:34 GMT

According to this Bug ID CSCwa45652 , Prime 3.10 is affected by Apache vulnerabilite and there´s no workaround or fixed release.

Apache 2.4.49 < 2.4.51 Path Traversal Vulnerability

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa45652

Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l

Ani T — Mon, 03 Oct 2022 18:07:55 GMT

How soon can we expect a fix for this issue? Is there a golden image for Prime Infra that we can use while we wait for this issue to be fixed?

Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l

przemyslaw.wieczorek — Thu, 19 Jan 2023 14:21:12 GMT

Anyone know when this will be fixed?

Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l

Mkvts — Mon, 13 Mar 2023 13:47:28 GMT

Anyone know if version Apache 2.4.53 is used in Prime 3.10.3?

Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l

przemyslaw.wieczorek — Mon, 13 Mar 2023 14:21:05 GMT

Hi,

Prime 3.10.3 has Apache version : 2.4.54. However now latest release of Apache is 2.4.56 😞

Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l

hemmerling — Mon, 10 Apr 2023 18:22:53 GMT

Is there an ETA for when a patch will be released to update Apache to <2.4.56, there are multiple critical vulnerabilities with the version in 3.10.3?

Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l

Scott Fella — Tue, 11 Apr 2023 00:11:38 GMT

You should reach out to your Cisco SE. Since Prime has now been EOL, release dates might change.

Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l

aharsh — Tue, 11 Apr 2023 00:15:42 GMT

It shouldn't change anything right now.

End of life of normal maintenance is September 2024. End of life of vulnerabilities (which is what this is) is September 2025, more than 2 years away.

Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l

Scott Fella — Tue, 11 Apr 2023 00:23:10 GMT

That is why you should reach out to your rep. It's the only way to see when they plan or if they plan on fixing that. Or just open a TAC case and ask.

Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l

alexhunter — Mon, 12 Jun 2023 09:37:06 GMT

Apparently there is patch 3.10.4 to fix the Apache vulnerability on its way, although still not sure when that will be. Logged a couple of TAC cases with Cisco and it was tentatively scheduled for the 2nd week of May, and then got told the release date for this fix would be within a day of around 1st-2nd June under the second raised TAC.

Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l

Mkvts — Tue, 18 Jul 2023 05:20:30 GMT

Just checked and the version 3.10.4 is available for me now. From what I can see a lot of caveats around apache are fixed. But I cannot find anything related about CSCwa45652. Did anybody install this version and know if this security issue is fixed? Any problems noticed when upgrading to this version?

Re: Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or l

Mkvts — Tue, 12 Sep 2023 10:21:28 GMT

I can confirm problem is fixed for us using version 3.10.4.