cisco ip telephony products vulnerability

[Bekzod Fakhriddinov]

Hi guys. I was looking for cisco bug reports to find  of cisco ip telephony products exposure  to this vulnerability "Jakarta multipart parser used in Apache Struts2 : On March 7^th Apache issued an emergency security alert as a component of the Apache Struts application was exposing a high-risk remote command execution vulnerability (CVE-2017-5638)^[1].

The vulnerability allows an attacker to include code in the "Content-Type" header of an HTTP request ^[2] to exploit the vulnerable 'Jakarta' (multi-part parser) java class, which is used within an application for file uploads. This vulnerability can allow an unauthenticated remote attacker to take control of a system." 

I found this :  Evaluation of ciscocm for struts2-jakarta rce vulnerability, CSCvd49840. 

We have 10.5 versions of CUCM,CUC, CUCM IM&P and Prime server .   CSCvd49840 report shows vulnerability  affects only 11 and 11.5 and nothing about 10.5 , does it mean 10.5 is not affected by this vulnerability ? 

Thank you 

P.S. Here is the link to the affected cisco products : https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170310-struts2

[Leo Laohoo]

Phones don't run Apache so the phones ain't affected.  

Cisco, as of today (14 March 2017), is still investigating which product(s) are affected by this exploit.

Keep an eye out for the page (or get RSS) for update(s).

[Bekzod Fakhriddinov]

Leo, thank you for respond, but nobody mentioned here that phones are running Apache.  CUCM,CUC, CUCM IM&P and Prime server may run Apache and might be affected . As you can see in the link above version 11 and 11.5 of this products are affected BUT Cisco is not clear if 10.5 has this vulnerability too . 

[HARIS_HUSSAIN · Accepted solution]

I can see that it says prior  releases of CUCM are not affected for CSCvd49840

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvd49840

Conditions:
Exposure is not configuration dependent.
This affects 11.0 and 11.5 releases only. Prior release are not affected

[Bekzod Fakhriddinov]

thank you