The release notes cover the following topics:
- About VMware Smart Assurance Network Configuration Manager GA Patch
- What's New in this Release
- Installation
- Uninstallation
- Known Issues
- Resolved Issues
About VMware Smart Assurance Network Configuration Manager GA Patch
A patch provides one or more fixes to a VMware Smart Assurance Network Configuration Manager (NCM) product. A patch can only be applied to the specific major or minor release and Service Pack of the particular product for which it is intended, this is called the product’s baseline.
What's New in this Release
The VMware Smart Assurance 10.1.6.1 introduces the following enhancement:
- Improved protection against Log4j vulnerability:
- Updated Apache Log4j version to 2.17.1 to resolve CVE-2021-44228, CVE-2021-45105, and CVE-2021-45046, in VMware Smart Assurance - Network Configuration Manager (NCM).
Installation
Installation instructions included in this section are for the Linux and Cent OS operating environments.
Note: This patch must be installed on all distributed Network Configuration Manager servers.
In the examples in both the Install and Uninstall instructions, [Product Directory] is used; however you must substitute [Product Directory] with your actual installation directory path.
You can determine your product installation directory by examining /etc/voyence.conf, and look for the text VOYENCE_HOME.
Use the following steps to install this patch on Linux:
On an application, device, database, or combination server
Follow these steps:
| Step | Action | Command |
|---|---|---|
| 1 | Run the NCM patch installer for Linux. | For Linux: bash NETWORK_CONFIGURATION_MANAGER_10_1_6_1_XX_Linux.bin Follow the prompts to install. Note: Where XX represents the build number. |
Verifying the installation
To verify the Network Configuration Manager patch installation, follow these steps.
| Step | Action | Command |
|---|---|---|
| 1 | Open the Help menu. | Click the Help option on the Network Configuration Manager menu bar. |
| 2 | Open the About window. | Select About. The About Network Configuration Manager window opens. |
| 3 | Verify the version of this release. | The version of this release is 10.1.6 [Platform] Patch 1. |
Note: After installing the Patch, the NCM UI cache must be cleared in the client host.
Uninstallation
Follow these steps:
| Step | Action | Command |
|---|---|---|
| 1 | Navigate to the patch directory. | cd [Product Directory]/Hotfix/NETWORK_CONFIGURATION_MANAGER_10_1_6_1/ |
| 2 | Run the patch uninstall script. | perl rollbackHotfix.pl |
Verifying the uninstallation
To verify that Network Configuration Manager patch is uninstalled, do the following:
| Step | Action | Command |
|---|---|---|
| 1 | Open the Help menu. | Click the Help option on the Network Configuration Manager menu bar. |
| 2 | Open the About window. | Select About. The About Network Configuration Manager window opens. |
| 3 | Verify the version of this previous release. | The version of the previous release is 10.1.6 [Platform] [patch release number if previous installed]. |
Resolved Issues
- Remote code execution vulnerability CVE-2021-44228, CVE-2021-45105 and CVE-2021-45046 in Apache Log4j on VMware Smart Assurance Network Configuration Manager (NCM).
The security vulnerabilities https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45105 and https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046 have been determined for affected components in VMware Smart Assurance Network Configuration Manager (NCM).
It's highly recommended to upgrade the VMware Smart Assurance Network Configuration Manager (NCM) 10.1.6 to patch 10.1.6.1.
Uninstalling of VMware Smart Assurance Network Configuration Manager (NCM) 10.1.6.1 patch is not recommended, since it includes fix for critical security vulnerability in the Apache Log4j.
Known Issues
- Log4j jars are not replaced in NCM UI Client.
In case you are using NCM UI Client to launch NCM GUI, follow the steps to update the log4j jars:
- Go to the <ncm-ui installed location>\lib of Windows\Linux Server where ncm-ui client is installed.
For example: C:\Program Files\ncm-ui\lib in case of Windows.
- Delete existing log4j-api-2.14.1.jar, log4j-core-2.14.1.jar, and log4j-slf4j-impl-2.14.1.jar jars.
- Go to $VOYENCE_HOME/ncmcore/webapps/voyence/lib directory in NCM server.
- Copy log4j-api-2.17.1.jar, log4j-core-2.17.1.jar, and log4j-slf4j-impl-2.17.1.jar jars from $VOYENCE_HOME/ncmcore/webapps/voyence/lib directory of NCM server to <ncm-ui installed location>\lib of Windows\Linux Server where ncm-ui client is installed.
- Go to the <ncm-ui installed location>\lib of Windows\Linux Server where ncm-ui client is installed.
