Looking for old log4j santricity doc

[DouglasNelson]

Hi,

   We decommissioned an old e5660 and at the time we recall that we were told that we had to also delete the supporting version of santricity due to the log4j issue and the fact that NetApp would not be patching the old EOS version of Santricity that supported the EOS e5660.

   We are now (much later) being challenged to provide doc showing that the software supporting the E5660 had the log4j bug and was not going to be patched due to being EOS. Of course being EOS and decommed, the serial # is useless for opening a ticket. 🙂

   Any docs backing us up would be greatly appreciated. Thanks

[AlexDawson · Accepted solution]

Hi there,

I don't see Santricity listed under any of the CVEs related to log4j on security.netapp.com - however there is a security vulnerability in Santricity 8.40 with regards to TCP sequence prediction - https://security.netapp.com/advisory/ntap-20190802-0001/

[kryan]

I agree with Alex - there is no evidence that SANtricity 8.x or 11.x shipped log4j.

Perhaps it was the VxWorks issue that led to the decommissioning.

[ahmadm]

SANtricity Storage Manager was not affected by Log4j issue.

[elementx]

> Any docs backing us up would be greatly appreciated.

E-Series and SANtricity were affected. See in Affected Products tab.

https://security.netapp.com/advisory/ntap-20211210-0007/

> the fact that NetApp would not be patching the old EOS version of Santricity that supported the EOS e5660.

Unless you find a post-CVE-dated update for both affected components that support E5600 in Downloads, then there's been no updates i.e. the fixes never made it in.

[AlexDawson]

My reading of that advisory is different to yours. Can I ask you to check again?

[elementx]

Yep, not affected. CTRL+F got me, didn't see that "Not affected" header.