No upgrade action is necessary for customers who have already applied a recommended release to address the March 2019 Cisco FXOS and NX-OS Software bundle. Prepared to provide the URL of this advisory as evidence of entitlement Point of sale should obtain upgrades by contacting the Cisco TAC: Ĭustomers should have the product serial number available and be Vendors but are unsuccessful in obtaining fixed software through their Service contract and customers who make purchases through third-party Customers Without Service ContractsĬustomers who purchase directly from Cisco but do not hold a Cisco If the information is not clear, customers are advised toĬontact the Cisco Technical Assistance Center (TAC) or their contracted Software configurations will continue to be supported properly by the In all cases, customers should ensure that the devices to be upgradedĬontain sufficient memory and confirm that current hardware and Regularly consult the advisories for Cisco products, which are availableįrom the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution. When considering software upgrades, customers are advised to Software updates do not entitle customers to a new software license,Īdditional software feature sets, or major revision upgrades. Upgrade to software that was previously purchased. Have a valid license, procured from Cisco directly, or through a CiscoĪuthorized reseller or partner. Otherwise using such software upgrades, customers agree to follow theĪdditionally, customers may only download software for which they By installing, downloading, accessing, or Customers may only install andĮxpect support for software versions and feature sets for which they Vulnerability described in this advisory. This advisory is available at the following link:Ĭisco has released free software updates that address the There are no workarounds that address this vulnerability. The attacker would need administrator credentials for the targeted device.Ĭisco has released software updates that address this vulnerability. A successful exploit could allow the attacker to perform arbitrary command injection. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a set of RPM-related CLI commands. The vulnerability is due to the lack of a proper locking mechanism on critical variables that need to stay static until used. A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use (TOCTOU) race condition to corrupt local variables, which could lead to arbitrary command injection.

Nexus package manager