Skip to main content
Solved

Commvault Log4j vulnerability - need both updates??

  • 16 December 2021
  • 4 replies
  • 1536 views

Hello -  

Commvault v20.11.77 

so I copied the Log4J windows updates and Linux updates to the cache.  I see them in there..

SNIP:

 

When I performed the upgrade software option I noticed on my windows clients I only see 1 of the 2 windows patches?  Im wondering why

Snip

 same with my linux clients:

 

Do I need to perform the upgrade one patch at a time? or are both patches needed?  Im a little confused.   Im not proficient with commvault.

 

I was expecting to see both “4562” & “4563” for windows clients and both “4561” & “4563” for the linux clients.  Please advise.. Thanks

I ran the updates all at the same time..  Maybe I needed to do them one at a time?   They all are in the cache details..

Thanks

BC

Same here, after adding the 2nd Log4j hotfix (to address 2.16) from Commvault today to my cache, Commcell showing all clients up-to-date.

4562 is in the contentstore and installed on clients, but 4574 will not add the contentstore when performing the copy software function. 

Hi, I would recommend you to extract the downloaded hotfix file, and browse it, so you’d see quickly if it is embedded in the file or not.

I’m on FR24 and I do have the files as expected from the hotfix file, and in the SW cache after its copy to it.. 

The files from the hotfix (my env)

Windows sample of SW content post-copy to SW cache :

 

If the file just downloaded from CV site doesn’t contain the hotfix files, then let’s have them checked.

Otherwise, something went wrong between the hotfix file extract its copy. 

Thanks. In our case, we did download the hotfix files for v11 SP20, extracted the files to a folder, and in the Commcell used the copy software function to pull the files into the contentstore. For whatever reason, 4574 patches are in the extracted folder, and Commcell says they were imported correctly, but when I check the contentstore, they are not there. Thus I am not able to deploy the 2nd Log4j hotfix..

 

We used the same method with the first Log4j hotfix , everything worked as expected.

 

Maybe a bug or something specific to our environment.

Nevermind - it turns out the update did make it to our contentstore, we had moved it previously. Additionally, the 4574 patch is not applicable to our environment. 

Reply


Terms & ConditionsCookie settings