HPE Storage Quorum Witness Software and log4j

[Lljfk]

Does anyone know if the latest version of the file witness appliance has log4j? I have an older one and it looks like it has log4j 1.x. I know this is not affected directly by the log4j 2.x exploit but 1.x is end of life and the guidence from apache was upgrade to the latest as 1.x does have other CVEs

[support_s]

System recommended content:

1. Installing and Updating HPE Quorum Witness for HPE Primera and HPE 3PAR | Updating existing Quorum Witness server software

2. Installing and Updating HPE Quorum Witness for HPE Primera and HPE 3PAR

If the above information is helpful, then please click on "Thumbs Up/Kudo" icon.

Thank you for being a HPE community member.

[sbhat09]

Hello @Lljfk,

Neither 1.x nor 2.x. QW v3.0.014 is the recommended version to address the CVEs before.

But here is the list of HPE products that are safe from log4j vulnerability. But I don't Quorum Witness in the list - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00120086en_us

Regards,
Srinivas Bhat

If you feel this was helpful please click the KUDOS! thumb below!
Note: All of my comments are my own and are not any official representation of HPE.

[Cali]

If your Storage OS is 3.2.2 or higher, install Quorum 3.0.
This is only a *.rpm Install File based on CentOS 7 and you can apply any OS Fix you want.

Cali