Do you know whether Cisco Networks Add-on has a risk or not? Log4Shell (CVE-2021-44228 and CVE-2021-45046)

[yuhshi]

Hello,

I'm trying to find out recent CVE-2021-44228 and CVE-2021-45046( log4j).

I use Cisco Networks Add-on that is not supported by splunk.

We can see impacted products by CVE-2021-44228 and CVE-2021-45046 from below link. And I know Cisco Networks Add-on isn't written in that.

Splunk Security Advisory for Apache Log4j (CVE-2021-44228 and CVE-2021-45046) | Splunk

But, I'm afraid that whether Cisco Networks Add-on has a risk or not, because it isn't supported by splunk.

Do you know whether Cisco Networks Add-on has a risk or not?

If it has a risk, please tell me how to resolve it.

Thanks.

[venkatasri]

Hi @yuhshi 

By looking at the add-on - https://splunkbase.splunk.com/app/1467/

contents doesn't have any .jar lib and it only contains .conf files, this is not supported by Splunk you can double check with developer.

https://splunkbase.splunk.com/app/1467/#/details

Please post a question on Splunk Answers and tag it with "Cisco Networks Add-on" if there is anything you would like to see in this app.

 ---

An upvote would be appreciated if this reply helps!

[yuhshi]

Hi,@venkatasri

Thanks for your comment!

I tagged "Cisco Networks Add-on" in my question after reading your comment.

And I'm going to wait developer's comment.

Thanks.