Dell Storage Manager Client / log4j update

Have other 19.x successfully upgraded to latest 20.x.  I have more than 15 (only one windows) data collectors to go.... i will check version next time.

Btw: the fixed DSM Client ships out with a stone aged log4j-1.2.x which also is vulnerable. But hey... also a 2.17 is bundled

Unfortunately, this didn't work for me. The upgrade to 20.1.1.716 seemed to work fine but I didn't get the UI after upgrading to 20.1.2.14.

Hi Joerg,

Yeah, I tried that. Seems like the webUI just doesn't come back up. I can ping them appliance and the console shows up but there's not much else I can do. I might have to open a ticket.

Thanks,
Ed

20.1.2 is still coming with log4j-1.2.x which is also vulnerable :

C:\Program Files (x86)\Dell\Enterprise Manager\msagui\lib\log4j-1.2.13.jar

And 2.17.0 which should also be updated to 2.17.1 :

C:\Program Files (x86)\Dell\Enterprise Manager\msagui\lib\log4j-core-2.17.0.jar

CVE-2022-23307, CVE-2022-23302, CVE-2021-44832 and CVE-2022-23305 (reported by Microsoft Defender ATP)

Any info on when a fix will be released ?

Any news on this ?

Hello Stephan The Valley and SC3020,

I will check into this and update you.

Hi, same there. Update from Virtual Appliance 20.1.1.716 to VA 20.1.2.14 doesn't work .

We apply the update and nothing. Still on the same version and the datacollector doesn't reboot too.

If someone encounters the same problem , any help would be appreciated.

Thanks

Hello,

It looks like those are false positive : https://www.dell.com/support/kbdoc/000194872

Dell EMC PowerPath Management Appliance False Positive Security Vulnerabilities

 CVE-2022-23302, CVE-2022-23305 & CVE-2022-23307

This article provides a list of security vulnerabilities that cannot be exploited on PowerPath Management Appliance 3.2*, but which may be flagged by security scanners.

Recommendations:

The vulnerabilities listed in the table below are in order by the date on which PPMA Engineering determined that the PowerPath Management Appliance  3.2* was not vulnerable.

Hi ! 20.1.2 is still coming with log4j-1.2.x which is flagged by scan for CVE-2021-4104. Is is also a false positive? is it safe to remove it? 

Hi,

Yes, it is a false positive based on the kb article that Charles linked previously. https://dell.to/3MOaiQa

Let us know if you have any additional questions.

https://www.dell.com/support/home/en-ca/drivers/driversdetails?driverid=2wnmw

Hello, popping in to drop this. I hope it helps. Provided to me by Dell Support. 

Here is the update for Storage Manager VA

Dell Storage Manager - 2020 R1.2 Release (Full Release) | Driver Details | Dell US

Here is the update for Windows

Hello

in our last vulnerability scan (this month) Dell Storage Manager (newest version 20.1.2.14 already installed) was again listed with a new vulnerability: CVE-2023-26464

There is no info at all for this CVE in Dell support. Please update your security advisory page and tell us, if the current DSM version is really affected or if it is a false positive.

Please also update https://www.dell.com/support/kbdoc/en-us/000196773 then.

Thanks

hello, can you provide the link to the download that patches this vulnerability for DSM