DSA-2021-274: Dell EMC Data Domain Security Update for Apache Log4j Remote Code Execution Vulnerability (CVE-2021-44228 and CVE-2021-45046)

Summary: Dell EMC Data Domain workaround and mitigation is available before remediation for the Apache Log4j Remote Code Execution Vulnerability that may be exploited by malicious users to compromise the affected system. Dell recommends implementing this remediation as soon as possible in light of the critical severity of the vulnerability. ...

Αυτό το άρθρο ισχύει για Αυτό το άρθρο δεν ισχύει για Αυτό το άρθρο δεν συνδέεται με κάποιο συγκεκριμένο προϊόν. Δεν προσδιορίζονται όλες οι εκδόσεις προϊόντων σε αυτό το άρθρο.
Δείτε άλλους πόρους

Impact

Critical

Details

Third-party Component CVEs More information
Apache Log4J CVE-2021-44228 Apache Log4j Remote Code Execution 
  CVE-2021-45046  Apache Log4j Remote Code Execution
Third-party Component CVEs More information
Apache Log4J CVE-2021-44228 Apache Log4j Remote Code Execution 
  CVE-2021-45046  Apache Log4j Remote Code Execution
Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.

Επηρεαζόμενα προϊόντα και αποκατάσταση

Product  Affected Versions  Updated Versions  Link to Update 
Data Domain (PowerProtect DD DDMC and DDSM) 
 		 Versions from 7.3.0.5 to 7.7.0.6  
 
Note: All 6.x,7.0.x,7.1.x,7.2.x. 7.7.0.7 and later, 7.6.0.30 and later are not impacted.		 7.8.0.0 or later
7.7.1.0 or later		 7.8.0.0 upgrades DDOS to 7.8 release
7.7.1.0 upgrades DDOS to 7.7 release

These releases include log4j 2.17.1.
For more details about DDOS versions available for download, see the Dell KB article links below (requires log in to Dell Support to view articles):
https://www.dell.com/support/kbdoc/334649 
https://www.dell.com/support/kbdoc/525902 
Versions from 7.3.0.5 to 7.7.0.6. 
 
Note: All 6.x,7.0.x,7.1.x,7.2.x. 7.7.0.7 and later, 7.6.0.30 and later are not impacted. 		 No change  Minimum Disruptive Upgrades (MDU) Log4j to 2.17.1 with no change to the DDOS version. See the Dell KB article link below for instructions and download (requires log in to Dell Support to view article):
https://www.dell.com/support/kbdoc/000195510


Notes:

  • Log4j 2.16 resolves the vulnerabilities for CVE-2021-44228 and CVE-2021-45046.
  • Log4j 2.17 or later is required to resolve CVE-2021-45105 and CVE-2021-44832, but they do not impact PowerProtect DD DDMC and DDSM. See Dell KB article 186467: Dell EMC DataDomain False Positive Security Vulnerabilities for details.
  • Log4j 2.17.1 is also available in DDOS 7.2 (DDOS 7.2.0.90 or later) and DDOS 6.2 (DDOS 6.2.1.80 or later).
Product  Affected Versions  Updated Versions  Link to Update 
Data Domain (PowerProtect DD DDMC and DDSM) 
 		 Versions from 7.3.0.5 to 7.7.0.6  
 
Note: All 6.x,7.0.x,7.1.x,7.2.x. 7.7.0.7 and later, 7.6.0.30 and later are not impacted.		 7.8.0.0 or later
7.7.1.0 or later		 7.8.0.0 upgrades DDOS to 7.8 release
7.7.1.0 upgrades DDOS to 7.7 release

These releases include log4j 2.17.1.
For more details about DDOS versions available for download, see the Dell KB article links below (requires log in to Dell Support to view articles):
https://www.dell.com/support/kbdoc/334649 
https://www.dell.com/support/kbdoc/525902 
Versions from 7.3.0.5 to 7.7.0.6. 
 
Note: All 6.x,7.0.x,7.1.x,7.2.x. 7.7.0.7 and later, 7.6.0.30 and later are not impacted. 		 No change  Minimum Disruptive Upgrades (MDU) Log4j to 2.17.1 with no change to the DDOS version. See the Dell KB article link below for instructions and download (requires log in to Dell Support to view article):
https://www.dell.com/support/kbdoc/000195510


Notes:

  • Log4j 2.16 resolves the vulnerabilities for CVE-2021-44228 and CVE-2021-45046.
  • Log4j 2.17 or later is required to resolve CVE-2021-45105 and CVE-2021-44832, but they do not impact PowerProtect DD DDMC and DDSM. See Dell KB article 186467: Dell EMC DataDomain False Positive Security Vulnerabilities for details.
  • Log4j 2.17.1 is also available in DDOS 7.2 (DDOS 7.2.0.90 or later) and DDOS 6.2 (DDOS 6.2.1.80 or later).

Λύσεις και μετριασμοί

Disable UI using command "adminaccess disable HTTP" and "adminaccess disable HTTPS"

See Dell KB article 126375: PowerProtect and Data Domain core documents to view the Dell EMC DD OS Command Reference Guide for details.

Revision History

RevisionDateDescription
1.02021-12-15Initial Release
1.12021-12-17Update released
1.22021-12-29updated versions and workaround section
1.32022-01-04Added not impacted products
1.42022-01-28Added updated version 7.7.1.0
1.52022-04-20Updated Affected Products table

Related Information

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Νομική αποποίηση ευθύνης

Επηρεαζόμενα προϊόντα

Data Domain, Data Domain, Product Security Information
Ιδιότητες άρθρου
Article Number: 000194503
Article Type: Dell Security Advisory
Τελευταία τροποποίηση: 19 Σεπ 2025
Βρείτε απαντήσεις στις ερωτήσεις σας από άλλους χρήστες της Dell
Υπηρεσίες υποστήριξης
Ελέγξτε αν η συσκευή σας καλύπτεται από τις Υπηρεσίες υποστήριξης.