Version 1.6: April 13, 2022
Vulnerability Timeline Summary
December 9, 2021: A vulnerability, CVE-2021-44228, in the Apache Log4j Java logging library affecting all Log4j versions prior to 2.15.0 was disclosed.
December 14, 2021: A related vulnerability, CVE-2021-45046, disclosed that is addressed in Log4j version 2.16.0.
December 18, 2021: Apache released Log4j 2.17.0 to address a third vulnerability: CVE-2021-45105.
This information is based on Cisco’s investigation to-date and is subject to change. In the event of new information, Cisco will provide updates via this page. Resources
Cisco's Response
When the Apache Log4j vulnerabilities became known in December 2021, Cisco actively addressed them as quickly as possible. At this time, all affected Cisco products have either been remediated or a software update has been released. Cisco’s software updates for on-premises products are addressing CVE-2021-44228 and CVE-2021-45046 by updating to Log4j version 2.16.0, at a minimum, or an equivalent level of security protection. Cisco has reviewed CVE-2021-45105 and has determined that no Cisco products or cloud offerings are impacted by this vulnerability.
Please see the Products section of the security advisory for detailed information. Cisco Talos has blocked domains, IP addresses, and hashes that are related to attempted exploitation of the vulnerability. Please see the Talos threat advisory for information on available Snort SIDs, ClamAV signatures, and endpoint Cloud Indicators of Compromise.
Cisco IT enacted its emergency operations process and employed multiple methods to respond to this incident. We use various security measures to safeguard our systems and networks, including proactive inventory tools, scanning, and intrusion detection and prevention measures.
Common Questions
Q: What is Cisco’s approach to addressing the vulnerabilities disclosed for Apache Log4j?
When the vulnerabilities became known, Cisco worked to address the disclosed vulnerabilities as quickly as possible and prioritized software updates based on severity. Cisco’s software updates for on-premises products are addressing CVE-2021-44228 and CVE-2021-45046 by updating to Log4j version 2.16.0, at a minimum, or an equivalent level of security protection. Cisco has reviewed CVE-2021-45105 and has determined that no Cisco products or cloud offerings are impacted by this vulnerability.
The specific software update information for affected products can be found in the Products section of the security advisory.For Cisco Cloud Offerings, the security advisory includes a table that lists remediation status for CVE-2021-44228 (Log4j 2.15.0 update - column one) and remediation status for CVE-2021-45046 (Log4j 2.16.0 update - column two). Cisco has reviewed CVE-2021-45105 and has determined that no Cisco products or cloud offerings are impacted by this vulnerability.
Q: How has Cisco remediated the security vulnerabilities in its software updates?Cisco used a variety of software development methods to remediate the Log4j vulnerabilities in its products. Updating the version of Log4j is not the only remediation method. There may be alternative methods of remediation that can provide an equivalent level of security, such as removing the JndiLookup class from the log4j-core JAR file. Which method Cisco uses in a given situation depends upon various factors, including the product’s architecture, how Log4j is used in the product, the configuration of product features, and more. In all cases, Cisco worked to deliver effective fixes as quickly as possible using every possible method of remediating the vulnerabilities.
Q: Which Cisco products are affected by this vulnerability?Please see the Products section of the security advisory for the list of products affected by this vulnerability. All affected Cisco products have either been remediated or have a software update available.
Q: When will software updates for Cisco products be available?
All affected Cisco products have either been remediated or have a software update available. More information and links to software updates are available on the security advisory
Q: What support is available to customers for the software updates?
Customers that require assistance with this security vulnerability or have a question during or after installation of a software update have options depending on their contract situation:
Customers with a Cisco support contract: Online TAC resources are available at cisco.com/support including an option to open a new case. To change severity or escalate an existing case, use TAC Connect Bot to reach the case owner and duty manager, or contact the case owner directly. Alternately, you can contact TAC by phone.
Customers with a support contract from a contracted maintenance provider: Please contact your authorized support provider directly.
Customers without a support contract: Contact Cisco TAC by phone.
Q: Are there any product workarounds available? Workarounds, where available, are documented in the product-specific Cisco bugs, which are identified in the security advisory. Cisco has actively leveraged its array of security measures, including intrusion prevention and detection measures, to mitigate potential risks. Additionally, Cisco Talos has published signatures to help protect against potential threats on the threat advisory.
Q: Will Cisco provide software updates for products that have reached the End of Support milestone? At this time, Cisco provided software updates for currently supported products. Cisco PSIRT and Engineering do not evaluate software that has passed the End of Support milestone, and it will not be listed in the security advisory. For additional information, please review the Security Vulnerability Policy and the End-of-Sale and End-of-Life Products list.
Q: How many products has Cisco assessed?
Cisco investigated over 200 products and determined around 50 products contain the Apache vulnerability and more than 130 products do not.
Q: Has Cisco seen exploitation of Cisco products?
The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerability in the Apache Log4j library. We ask our customers to please review the security advisory for the latest information and take appropriate action.
Q: How is Cisco protecting its own corporate IT network?
Cisco uses various security measures to safeguard its systems and networks, including intrusion detection and prevention measures. Read more about how our Security & Trust organization helps protect Cisco.
Q: Are Cisco’s vendors/suppliers impacted by this issue?
Cisco engaged with vendors and supply chain partners to assess any potential impact to their businesses. Q: Did Cisco shut down any services as a result of this vulnerability? No. All Cisco services remain operational.
Q: Which software version(s) of Log4j were used at Cisco? Several different software versions of the Apache library were in use at Cisco.
This document is part of the Cisco Security portal. Cisco provides the official information contained on the Cisco Security portal in English only.
This document is provided on an “as is” basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information in the document or materials linked from the document is at your own risk. Cisco reserves the right to change or update this document without notice at any time.
Back to Top
