topic Looking for old log4j santricity doc in EF & E-Series, SANtricity, and Related Plug-ins

Looking for old log4j santricity doc

DouglasNelson — Fri, 27 Sep 2024 18:21:03 GMT

Hi,

We decommissioned an old e5660 and at the time we recall that we were told that we had to also delete the supporting version of santricity due to the log4j issue and the fact that NetApp would not be patching the old EOS version of Santricity that supported the EOS e5660.

We are now (much later) being challenged to provide doc showing that the software supporting the E5660 had the log4j bug and was not going to be patched due to being EOS. Of course being EOS and decommed, the serial # is useless for opening a ticket. 🙂

Any docs backing us up would be greatly appreciated. Thanks

Re: Looking for old log4j santricity doc

AlexDawson — Mon, 30 Sep 2024 03:54:17 GMT

Hi there,

I don't see Santricity listed under any of the CVEs related to log4j on security.netapp.com - however there is a security vulnerability in Santricity 8.40 with regards to TCP sequence prediction - https://security.netapp.com/advisory/ntap-20190802-0001/

Re: Looking for old log4j santricity doc

kryan — Mon, 30 Sep 2024 14:52:29 GMT

I agree with Alex - there is no evidence that SANtricity 8.x or 11.x shipped log4j.

Perhaps it was the VxWorks issue that led to the decommissioning.

Re: Looking for old log4j santricity doc

ahmadm — Mon, 30 Sep 2024 20:35:50 GMT

SANtricity Storage Manager was not affected by Log4j issue.

Re: Looking for old log4j santricity doc

elementx — Tue, 01 Oct 2024 03:47:39 GMT

> Any docs backing us up would be greatly appreciated.

E-Series and SANtricity were affected. See in Affected Products tab.

https://security.netapp.com/advisory/ntap-20211210-0007/

> the fact that NetApp would not be patching the old EOS version of Santricity that supported the EOS e5660.

Unless you find a post-CVE-dated update for both affected components that support E5600 in Downloads, then there's been no updates i.e. the fixes never made it in.

Re: Looking for old log4j santricity doc

AlexDawson — Tue, 01 Oct 2024 08:09:57 GMT

My reading of that advisory is different to yours. Can I ask you to check again?

Re: Looking for old log4j santricity doc

elementx — Tue, 01 Oct 2024 10:03:41 GMT

Yep, not affected. CTRL+F got me, didn't see that "Not affected" header.