ISE Patch vs RHEL Patch

[Joshua Turner]

Customer needs to know what are the best practices for not only patching ISE itself, but the underlying RHEL kernel should there be a CVE that needs to be patched for RHEL by their Linux Admin. The understanding is that Cisco will not provide the RHEL patch, the customer Linux Admin would have to complete that task. How would the customer know if patching RHEL will break ISE itself. 

[Jason Kunst]

Customer needs to work through TAC. All patching will be done by the ISE team. There is no way for customer to patch the system themselves.

[Joshua Turner]

Hey Jason,
Thanks for the reply. Here's what I got from TAC and ISE-PM

TAC: "Any RHEL vulnerabilities found would need to be patched by the Linux Admin and not via ISE patch."

ISE-PM: "We do not issue patches for Linux OS vulnerabilities. That would come from a Linux admin."

So this leaves the question, how can a customer patch the Linux OS without knowing if it will break ISE.

[Jason Kunst]

Please get me the info on who stated this.

ISE would only be patched by ISE developers. They are the only ones that have access to the appropriate files and systems to make it happen.

Please forward this to the TAC and PM. This is coming from technical marketing team

[hslai]

Perhaps some mis-understanding. If possible, please share with me the TAC case number to take a look.

Some of OS changes are not patchable; e.g. CSCvg15984

[Joshua Turner]

TAC case 684817304

[hslai · Accepted solution]

From the TAC case notes, the customer's inquiry is fairly general. 

Chetankumar Phulpagare stated it correctly that the specific issues are handled by reporting, bug filing and other processes, and then reviewed by our engineering teams. ISE patches are possible if the solutions are more contained; otherwise, they might require upgrading a newer ISE release.

[Chetankumar Phulpagare]

Similar situations have come in the past with OpenSSL vulnerabilities. The process for such situations is that Cisco PSIRT gets notified about third party vulnerabilities and they coordinate patch fix testing for Cisco application with respective BU. BU will track the fix using a bug ID and PSIRT with publish an advisory with all the details of when and what patch, in this case ISE patch, will have the fix for the vulnerability. 

Hope this helps!