CSCwa47133 - Evaluation log4j CVE-2021-44228

[Adam Hinchliff]

Unfortunately we are running ISE1.3 (currently trying to migrate to 3.) before everyone lays into me about running unsupported version can Cisco comment if log4j 1.x.x is impacted and if they will offer a workaround.

[Leo Laohoo]

The list of affected products can be found here:  Vulnerability in Apache Log4j Library Affecting Cisco Products

I do not believe any products that are already end-of-support will be patched.

[bearman97]

While log4j 1.x is not explicitly listed as not affected, the announcements I've seen have stated that log4j2 >= 2.0-Beta9 and <= 2.14.1 are affected.

Apache's announcement is currently at logging.apache.org/log4j/2.x/security.html

Update Dec 14:  Apache has updated their announcement to explicitly state that log4j v1.x is NOT affected.

They also mention that log4j v2.15 does NOT fix the vulnerability in non-default configurations; v2.16 is required to fully remediate.  I imagine that has some developers/testers groaning as they have to patch and restart testing again.