[CVE-2021-44228] Apache Log4j2 RCE

[dawoon_lee]

Hello.

Our customer is running a Ruckus SmartZone (sz-100) controller.
The version of the controller is 5.1.1.0.598.

The customer asked if the SmartZone has the following this security vulnerabilities.

** Vulnerability: [CVE-2021-44228] Apache Log4j2 RCE

Thank you for your valuable answers to the above questions.

[mark_pledl]

@muu 

Yes it looks like. Maybe something wrong with them.

[mark_pledl]

The are back now. But KBA #12025 is still missing.

[JTakaMT]

Missing for me as well. I have a ticket that was already opened and updated the support ticket asking about the KB article. 

[jtchi]

Anyone found the proper install instructions for vSZ 5.2.2?  When I follow the link from SZ and vSZ - Steps to Implement CVE-2021-44228 log4j2 Patch -- KBA # 000012025 and search for that number nothing comes up.  Why are Ruckus documentation and download processes so convaluted?

[diego_garcia_de]

@jtchi Same here. Searching for downloads for smartzone there is nothing recently released. All the posted links to KSPs lean no-where (error pages / 404 pages ). Searching the KB for 000012025  returns nothing. Has this been marked as "externally available"?