log4j advisory | VSC 9.7.x

[Ontapforrum]

Hi NetApp,

Could you provide more clarity on the list of 'Affected Products' mentioned in the log4j advisory.

My query is specifically for 'Virtual Storage Console'. In the following weblink, it mentions 'ONTAP Tools for VMware vSphere' as affected product, which is a new name for VSC from 9.8 onwards. VSC's last version is 9.7.x.

Does this vulnerability only applies to 'ONTAP Tools for VMware vSphere' (which is 9.8 onwards) ?
https://security.netapp.com/advisory/ntap-20211210-0007/

Many thanks!

[paul_stejskal]

I will check with PSIRT and get an update. Good question.

[paul_stejskal]

Assume it is affected. Also end of version support was Oct 20 for 9.7.1, so you should upgrade anyway.

https://mysupport.netapp.com/site/info/version-support

[Ontapforrum · Accepted solution]

It's affected, this is the workaround:

ONTAP tools for VMWare vSphere (VSC) - CVE-2021-44228 Apache Log4j Vulnerability - Workaround - NetApp Knowledge Base