CSCwa47133 - ISE 3.1 - Log4j Patch Availability?

[pkarelis]

ISE 3.1 ( 3.001(000.518) a/k/a 3.1.0.518) is listed as vulnerable, and the current patch that is available is showing for ISE 2.4-3.0.  When will an ISE 3.1 patch become available?

Also, a public service announcement:  the 3.0 patch doesn't work on ISE 3.1 in case you get impatient like me. 

I attempted to install 2.4-3.0 patch on ISE 3.1, and the install worked, but ISE wouldn't start after the install with the following error:

PAN01/admin# application start ise
% Error: ISE Integrity Check Failed! One or more ISE program files appears to
%        be tampered with. Check system log for specific error(s).
% Application failed to start

ISE Started without issue after rollback of the patch.

[Arne Bier]

In fairness to Cisco, they did say that the patch was for ISE 2.4 through 3.0 - perhaps it's already fixed in ISE 3.1? Or they have not yet got around to fixing it. Or perhaps ISE 3.1 doesn't use this Apache library?  Who knows.

Nice try though

[Leo Laohoo]

Raise a TAC Case.

Latest update to the Vulnerabilities in Apache Log4j Library Affecting Cisco Products security bulletin (update 1.19) has stated hotfix for ISE 3.1 to be available on 17 December 2021.

[rpmoyer93]

Getting pretty late in the day for the east coast here for a release of the patch for 3.1.  Is this still expected today or should we be watching over the weekend?

[Leo Laohoo · Accepted solution]

---

@rpmoyer93 wrote:

Getting pretty late in the day for the east coast here for a release of the patch for 3.1.  Is this still expected today or should we be watching over the weekend?

---

ISE 3.1 Patch 1 is now available and can be found HERE.

ISE 3.1 Patch 1 Release Notes can be found HERE.

NOTE:  Applying ISE 3.1 Patch 1 will restart the services.

[Thompso75401]

What order should I use to patch my ise deployment w/ the log4j fix. Admin nodes, then mnt, then psn, etc...?

[marce1000]

 - The order is not important , and or also check this thread :

           https://community.cisco.com/t5/network-access-control/log4j-hotfix-cscwa47133-ise-distributed-environment/m-p/4521609#M571847

 M.