topic Re: log4j advisory | VSC 9.7.x in ONTAP Discussions

log4j advisory | VSC 9.7.x

Ontapforrum — Wed, 04 Jun 2025 10:07:19 GMT

Hi NetApp,

Could you provide more clarity on the list of 'Affected Products' mentioned in the log4j advisory.

My query is specifically for 'Virtual Storage Console'. In the following weblink, it mentions 'ONTAP Tools for VMware vSphere' as affected product, which is a new name for VSC from 9.8 onwards. VSC's last version is 9.7.x.

Does this vulnerability only applies to 'ONTAP Tools for VMware vSphere' (which is 9.8 onwards) ?
https://security.netapp.com/advisory/ntap-20211210-0007/

Many thanks!

Re: log4j advisory | VSC 9.7.x

paul_stejskal — Thu, 16 Dec 2021 14:14:30 GMT

I will check with PSIRT and get an update. Good question.

Re: log4j advisory | VSC 9.7.x

paul_stejskal — Thu, 16 Dec 2021 14:18:48 GMT

Assume it is affected. Also end of version support was Oct 20 for 9.7.1, so you should upgrade anyway.

https://mysupport.netapp.com/site/info/version-support

Re: log4j advisory | VSC 9.7.x

Ontapforrum — Sun, 19 Dec 2021 22:47:46 GMT

It's affected, this is the workaround:

ONTAP tools for VMWare vSphere (VSC) - CVE-2021-44228 Apache Log4j Vulnerability - Workaround - NetApp Knowledge Base