NetApp Manageability SDK 9.8P10 中的漏洞 CVE-2026-49844

最后更新
另存为PDF

Views:

Visibility:: Public

Votes:: 0

Category:: netapp-manageability-sdk

Specialty:: tools

Last Updated:

适用于

NetApp 可管理性 SDK (NMSDK)
Apache Log4j 2.13.1 至 2.25.4 版本
运行 NMSDK 的 Linux 管理虚拟机
使用 NMSDK 的 ONTAP 自动化环境

问题

漏洞扫描在运行 NetApp Manageability SDK (NMSDK) 9.8P10 的 Linux 管理虚拟机上报告了以下发现。
该扫描在 zexplore.jar 和 manageontap-9.8P10.jar 中识别出 Apache Log4j 版本 2.19.0，并建议使用 Apache Log4j 的修复版本 2.25.5。
插件输出：

Path: /data/netapp-manageability-sdk-9.8P10/zedi/zexplore.jar
Installed version: 2.19.0
Fixed version: 2.25.5

Path: /data/netapp-manageability-sdk-9.8P10/lib/java/classes/manageontap-9.8P10.jar
Installed version: 2.19.0
Fixed version: 2.25.5

说明：

The version of Apache Log4j on the remote host is affected by a vulnerability (CVE-2026-49844): Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON.

主要症状：

Vulnerability detected in NMSDK JAR files due to outdated Log4j.
Customer asks if upgrading NMSDK to 9.8P12 will resolve the issue.
Concern if affected JAR files will be updated automatically with SDK upgrade.
Requests for guidance on remediation or workarounds.