Impact
Critical
Details
Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.
Affected Products and Remediation
| Product |
Affected Versions |
Updated Versions |
Link to Update |
Data Domain (PowerProtect DD DDMC and DDSM)
|
Versions from 7.3.0.5 to 7.7.0.6
Note: All 6.x,7.0.x,7.1.x,7.2.x. 7.7.0.7 and later, 7.6.0.30 and later are not impacted. |
7.8.0.0 or later
7.7.1.0 or later |
7.8.0.0 upgrades DDOS to 7.8 release
7.7.1.0 upgrades DDOS to 7.7 release
These releases include log4j 2.17.1.
For more details about DDOS versions available for download, see the Dell KB article links below (requires log in to Dell Support to view articles):
https://www.dell.com/support/kbdoc/334649
https://www.dell.com/support/kbdoc/525902 |
Versions from 7.3.0.5 to 7.7.0.6.
Note: All 6.x,7.0.x,7.1.x,7.2.x. 7.7.0.7 and later, 7.6.0.30 and later are not impacted. |
No change |
Minimum Disruptive Upgrades (MDU) Log4j to 2.17.1 with no change to the DDOS version. See the Dell KB article link below for instructions and download (requires log in to Dell Support to view article):
https://www.dell.com/support/kbdoc/000195510 |
Notes:
- Log4j 2.16 resolves the vulnerabilities for CVE-2021-44228 and CVE-2021-45046.
- Log4j 2.17 or later is required to resolve CVE-2021-45105 and CVE-2021-44832, but they do not impact PowerProtect DD DDMC and DDSM. See Dell KB article 186467: Dell EMC DataDomain False Positive Security Vulnerabilities for details.
- Log4j 2.17.1 is also available in DDOS 7.2 (DDOS 7.2.0.90 or later) and DDOS 6.2 (DDOS 6.2.1.80 or later).
|
| Product |
Affected Versions |
Updated Versions |
Link to Update |
Data Domain (PowerProtect DD DDMC and DDSM)
|
Versions from 7.3.0.5 to 7.7.0.6
Note: All 6.x,7.0.x,7.1.x,7.2.x. 7.7.0.7 and later, 7.6.0.30 and later are not impacted. |
7.8.0.0 or later
7.7.1.0 or later |
7.8.0.0 upgrades DDOS to 7.8 release
7.7.1.0 upgrades DDOS to 7.7 release
These releases include log4j 2.17.1.
For more details about DDOS versions available for download, see the Dell KB article links below (requires log in to Dell Support to view articles):
https://www.dell.com/support/kbdoc/334649
https://www.dell.com/support/kbdoc/525902 |
Versions from 7.3.0.5 to 7.7.0.6.
Note: All 6.x,7.0.x,7.1.x,7.2.x. 7.7.0.7 and later, 7.6.0.30 and later are not impacted. |
No change |
Minimum Disruptive Upgrades (MDU) Log4j to 2.17.1 with no change to the DDOS version. See the Dell KB article link below for instructions and download (requires log in to Dell Support to view article):
https://www.dell.com/support/kbdoc/000195510 |
Notes:
- Log4j 2.16 resolves the vulnerabilities for CVE-2021-44228 and CVE-2021-45046.
- Log4j 2.17 or later is required to resolve CVE-2021-45105 and CVE-2021-44832, but they do not impact PowerProtect DD DDMC and DDSM. See Dell KB article 186467: Dell EMC DataDomain False Positive Security Vulnerabilities for details.
- Log4j 2.17.1 is also available in DDOS 7.2 (DDOS 7.2.0.90 or later) and DDOS 6.2 (DDOS 6.2.1.80 or later).
|
Workarounds and Mitigations
Disable UI using command "adminaccess disable HTTP" and "adminaccess disable HTTPS"
See Dell KB article 126375: PowerProtect and Data Domain core documents to view the Dell EMC DD OS Command Reference Guide for details.
Revision History
| Revision | Date | Description |
| 1.0 | 2021-12-15 | Initial Release |
| 1.1 | 2021-12-17 | Update released |
| 1.2 | 2021-12-29 | updated versions and workaround section |
| 1.3 | 2022-01-04 | Added not impacted products |
| 1.4 | 2022-01-28 | Added updated version 7.7.1.0 |
| 1.5 | 2022-04-20 | Updated Affected Products table |
Related Information
Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide