Below is details of vulnerability -
Plugin Output:
Path : /data/netapp-manageability-sdk-9.8P10/zedi/zexplore.jar
Installed version : 2.19.0
Fixed version : 2.25.5
Path : /data/netapp-manageability-sdk-9.8P10/lib/java/classes/manageontap-9.8P10.jar
Installed version : 2.19.0
Fixed version : 2.25.5
Description:
The version of Apache Log4j on the remote host is affected by a vulnerability:
- Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. When a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document. An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing. (CVE-2026-49844)
Note that Nessus has not tested this issue but has instead relied only on the application's self-reported version number.
Can someone please provide more details to remediate this issue and way to fix whether we should upgrade SDk to 9.8P12 and it iwll include latest updated .jar file?
