UCS Manager - 1.4.1j and earlier - Apache Security Vuln?

[KRIS PATE]

I was running UCSM 1.3.1c and was notified by security that the web server component had a security vulverability.

I upgraded to 1.4.1j and had them rescan and they are still seeing it as being unpatched.

Has anyone else had their UCSM scanned for security vulnerabilites and found this?

Is there some documentation on which software versions are included in UCSM? (like the version of apache)
Any idea when a patched version will be included in UCSM?  Is it being fixed in the upcoming 1.4.1k?

http://httpd.apache.org/security/vulnerabilities_22.html

[Robert Burns · Accepted solution]

Greetings Kris,

UCS version 1.4 currently uses Apache version 2.2.15 - because at the time it was developed this was the most current release.  UCS will have the updated Apache fixes for 2.2.17 in the next major release - tentatively scheduled in the next 6 months. Apache updates/fixes will likely be incorporated into major UCS releases/updates.

After discussing the vulnerability conerns with the current version of Apache in 1.4, none of the vulnerabilities are relevant with UCS. Our development team looked into this and concluded UCSM will not be effected by libexpat related vulnerabilities and apr_bridage_split_line DoS  don’t have any effect on UCSM as we are not using this API.

Regards,

Robert

[KRIS PATE]

Robert,

Thanks for the thorough answer. I will let my security team know.

In the future is there any documentation that lists the different versions of Open Source software in use with UCSM?

Kris

[Robert Burns]

Yes.  Internally we've discussed this and it should be included in the next version of Release notes.

Regards,

Robert