[CVE-2021-44228] Apache Log4j2 RCE

[dawoon_lee]

Hello.

Our customer is running a Ruckus SmartZone (sz-100) controller.
The version of the controller is 5.1.1.0.598.

The customer asked if the SmartZone has the following this security vulnerabilities.

** Vulnerability: [CVE-2021-44228] Apache Log4j2 RCE

Thank you for your valuable answers to the above questions.

[eightohtwoeleve]

I trust the Ruckus engineers are on this case, working diligently as they can. I will wait until the patch is thoroughly tested and released. Thanks for all you do for us!

[Vineet_nejwala]

@eightohtwoeleven

Apologies for the inconvenience. The patch for all codes should be released by today "12/17/2021" EOD. The goal is :

We will have a KBA showing the process for loading the KSP on SZ.
The fixes /KSPs will be open for download for customers with/or without a support.
The aim is to ensure that our customers have the ability to self-help on existing versions as much as possible.

Atlast,Sorry for the delay, but this will be a better outcome for all our customers and us, once completed.

Best Regards

Vineet

[michiel_timmers]

We are +1 week in... and still no patch????

[mark_pledl]

@michiel_timmers 

patches are downloadable.

https://support.ruckuswireless.com/software

[muu]

Saw the patches briefly but now don't seem to appear on the downloads page anymore. Did they get pulled?