Certes have reviewed this vulnerability of the Log4j software package and we have determined that the CFNC software and the CEP software are not vulnerable.

The CEP software does not use this package or any java-based packages within the software.

The CFNC and TNM software do use this package, but the version installed is not vulnerable. All versions of CFNC use log4j-1.2.16. The versions that are impacted are Log4j2 versions 2.0-beta9 to 2.14.1. 

This includes all versions of CFNC/TNM and CEP software.

If you have any questions, please call the Customer Support line at: +1.888.277.8395 or +1.412.262.2571, option #2 or by email at: support@certesnetworks.com

New CryptoFlow Network Creator - CFNC (ver. 5.4.8504) Software Released:

Certes Networks has updated the CFNC software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

CFNC Version 5.4.8504

Release Notes:

CFNC 5.4.8504

New CryptoFlow Network Enforcer - ver. 5.4.1 Software Released:

Certes Networks has updated the c software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

NOTE: All CryptoFlow Network Enforcers running software version 5.2 and earliear must be upgraded to version 5.2a before upgrading to this latest release version 5.4.1.

CFNE Version 5.4.1

Release Notes:

CFNE 5.4.1

New CryptoFlow Network Enforcer - ver. 5.2.9 Software Released:

Certes Networks has updated the c software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

NOTE: All CryptoFlow Network Enforcers running software version 5.2 and earliear must be upgraded to version 5.2a before upgrading to this latest release version 5.2.9.

CFNE Version 5.2.9

Release Notes:

CFNE 5.2.9

New CryptoFlow Network Enforcer - ver. 5.2.7 Software Released:

Certes Networks has updated the c software for the ZTWAN platform. The new version of software has been released and is available from the Customer Portal for download.

NOTE: All CryptoFlow Network Enforcers running software version 5.2 and earliear must be upgraded to version 5.2a before upgrading to this latest release version 5.2.7.

CFNE Version 5.2.7

Release Notes:

CFNE 5.2.7

CVE-2017-5754, CVE-2017-5753, CVE-2017-5715

Are Certes products impacted by Spectre / Meltdown?

Yes. All modern CPU’s of the last 10 years or so are impacted.

What is the risk from using Certes products due to the Spectre / Meltdown vulnerabilities?

Certes believe the risk is quite low. These vulnerabilities require local access to the OS and the ability to run your own malicious code on the Certes platforms. Certes solutions are NOT multi-user or open to allow others to run their own code on our solution. Provided that customers have taken appropriate steps to prevent unauthorized access to Certes’ enforcer and management platforms then the risk is low.

What is Certes doing to address these Vulnerabilities?

Certes is monitoring the availability of patches. The first round of fixes for Spectre have been pulled by Intel. We are watching the situation closely and will apply and test the patches in our lab before inclusion in a future release of the software, if applicable. We will provide updates as more information becomes available.

If you have any questions, please call the Customer Support line at:

+1.888.277.8395

or

+1.412.262.2571, option #2

or by email at:

support@certesnetworks.com