Cisco Prime Infrastructure Version 3.10 Apache version 2.4.53 or later

[SIT Network Support]

We want to check currently our Cisco Prime running on Apache 2.4.50 (there is some Multiple Vulnerabilities) and want to know if there Apache version 2.4.53 or later. 

Please do provide us the work around on this as well 

[Flavio Miranda]

Hi

According to this Bug ID CSCwa45652  , Prime 3.10 is affected by Apache vulnerabilite and there´s no workaround or fixed release.

Apache 2.4.49 < 2.4.51 Path Traversal Vulnerability

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwa45652 

[Ani T]

How soon can we expect a fix for this issue? Is there a golden image for Prime Infra that we can use while we wait for this issue to be fixed?

[przemyslaw.wieczorek]

Anyone know when this will be fixed?

[Mkvts]

Anyone know if version Apache 2.4.53 is used in Prime 3.10.3?

[przemyslaw.wieczorek]

Hi,

Prime 3.10.3 has Apache version : 2.4.54. However now latest release of Apache is 2.4.56

[hemmerling]

Is there an ETA for when a patch will be released to update Apache to <2.4.56, there are multiple critical vulnerabilities with the version in 3.10.3?

[Scott Fella]

You should reach out to your Cisco SE.  Since Prime has now been EOL, release dates might change.

[aharsh]

It shouldn't change anything right now.

End of life of normal maintenance is September 2024. End of life of vulnerabilities (which is what this is) is September 2025, more than 2 years away.

[Scott Fella]

That is why you should reach out to your rep.  It's the only way to see when they plan or if they plan on fixing that.  Or just open a TAC case and ask.

[alexhunter]

Apparently there is patch 3.10.4 to fix the Apache vulnerability on its way, although still not sure when that will be. Logged a couple of TAC cases with Cisco and it was tentatively scheduled for the 2nd week of May, and then got told the release date for this fix would be within a day of around 1st-2nd June under the second raised TAC.

[Mkvts]

Just checked and the version 3.10.4 is available for me now. From what I can see a lot of caveats around apache are fixed. But I cannot find anything related about CSCwa45652. Did anybody install this version and know if this security issue is fixed? Any problems noticed when upgrading to this version?

[Mkvts]

I can confirm problem is fixed for us using version 3.10.4.