Verify ACI Python Version

Introduction

This document describes the ACI Python version policy and its implementation within Cisco APIC.

APIC Python Versioning Reference

Cisco APIC supports a specific range of Python versions that have been rigorously tested and verified to ensure compatibility and stability with its software. The supported Python versions can vary depending on the APIC software release.

Current Python Version Support

Current Python Version Support

The Technical Assistance Center (TAC) assists customers in determining if a different version of Python needs to be installed to address security vulnerability. One common issue is the detection of Python Unsupported Version Detection, which can be flagged as critical by various security scanners.

For example:

  Path              : /

  Port              : 1733

  Installed version : 3.7.6

  Latest version    : 3.10

  Support dates     : 2023-06-27 (end of life)

Verification Example

APIC# acidiag version
6.0(5h)             

APIC# python -V             
Python 3.8.10

The Python versions included in recent ACI software releases are:

APIC version 5.2(8h) >= Python 2.7.17
APIC version 6.0(1)   >= Python 3.7.6

APIC version 6.0(2)   >= Python 3.8.10

Security and Compatibility

All scripts executed through APIC are validated and tested by Cisco developers. These scripts are specifically built for the Python version included in the respective APIC release.

Updating to a different Python version, such as 3.10, on an APIC version originally deployed with an earlier version can alter the way ACI modules interact. This could potentially cause significant issues within the environment. Cisco developers cannot simply rewrite the Python modules to accommodate a new version, as most of the Data Management Engine (DME) scripts are tailored to specific Python versions.

Security Vulnerability Management

Development teams are continuously working to identify and address security breaches across all ACI components. When a vulnerability is discovered, it is documented under a Common Vulnerabilities and Exposures (CVE) code, and customers are promptly notified to take appropriate action. Cisco addresses these vulnerabilities through firmware updates for ACI, rather than by updating to the latest Python version.

Future Developments

Internal developments are currently underway to integrate Python 3.12 in upcoming releases of APIC. This ensures that our software remains secure and up-to-date with the latest Python advancements while maintaining compatibility and stability.

Related Information

• Nessus - Python Unsupported Version Detection
• Status of Python Versions