Field Notice: FN - 70542 - Unified Contact Center Enterprise - Tomcat Upgrade to Resolve CVE-2020-1938 Breaks Cceadmin and Websetup Page - Software Upgrade Recommended

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Revision History

Revision	Publish Date	Comments
1.0	07-May-20	Initial Release
1.1	17-Aug-21	Updated the Workaround/Solution Section

Products Affected

Affected OS Type	Affected Software Product	Affected Release	Affected Release Number	Comments
NON-IOS	Unified Contact Center Enterprise Virtual Machine Templates	11	11.6
NON-IOS	Unified Contact Center Enterprise Virtual Machine Templates	10	10.5
NON-IOS	Unified Contact Center Enterprise Virtual Machine Templates	11	11.0

Defect Information

Defect ID	Headline
CSCvt31436	CCE - Tomcat upgrade to resolve CVE-2020-1938 breaks cceadmin and websetup

Problem Description

An upgrade to Apache Tomcat on Unified Contact Center Enterprise (Unified CCE) components breaks the cceadmin and websetup page. This error message is given:

HTTP Error 500.0 - Internal Server Error Calling LoadLibraryEx on ISAPI filter "C:\icm\tomcat\bin\i386\isapi_redirect.dll" failed

This is a mandatory upgrade to address the vulnerability described in CVE-2020-1938. It might not be an option to revert back to an older Tomcat version.

Background

Tomcat version 7.0.100 or greater.

This error is given:

HTTP Error 500.0 - Internal Server Error Calling LoadLibraryEx on ISAPI filter "C:\icm\tomcat\bin\i386\isapi_redirect.dll" failed

Problem Symptom

The cceadmin and websetup page does not load after an upgrade to Tomcat 7.0.99 and later on Unified CCE 11.6.

Workaround/Solution

Workaround 1. Provide Permissions

The permissions message states:

C:\icm\tomcat folder does not have enough permissions.

In order to provide enough permissions in the Tomcat directory and subdirectories, complete these steps:

1. In Tomcat, inherit the security permissions:
   1. Right-click the Tomcat folder.
   2. Choose Security > Advanced.
   3. Click Enable Inheritance.
   4. Click Apply.
2. Stop Tomcat and modify these files:

   • <install_drive>:\icm\tomcat\conf\server.xml

   • <install_drive>:\icm\ssl\cfg\server-iis.xml

   • <install_drive>:\icm\bin\server.xml.IIS.custom

   In each file, replace this line:

   <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="127.0.0.1" maxPostSize="5242880" />

   with this line:

   <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="127.0.0.1" maxPostSize="5242880" secretRequired="false" allowedRequestAttributesPattern=".*" />

Workaround 2. Security Patch

Roll back the Tomcat security patch.

Workaround 3. Apply Patch

Available patches

11.6(2)ES54

12.0(1)ES52

12.5(1)ES20

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

• Open a service request on Cisco.com
• By email or telephone

Receive Email Notification For New Field Notices

My Notifications—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.