Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2022.3910 Security Bulletin: Liberty for Java for IBM Cloud is vulnerable to Identity Spoofing (CVE-2022-22476) 9 August 2022 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Liberty for Java Publisher: IBM Operating System: Linux variants Resolution: Patch/Upgrade CVE Names: CVE-2022-22476 Original Bulletin: https://www.ibm.com/support/pages/node/6611057 Comment: CVSS (Max): 5.0 CVE-2022-22476 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) CVSS Source: IBM Calculator: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L - --------------------------BEGIN INCLUDED TEXT-------------------- Liberty for Java for IBM Cloud is vulnerable to Identity Spoofing (CVE-2022-22476) Document Information Document number : 6611057 Modified date : 08 August 2022 Product : Liberty for Java Software version : All Operating system(s): Linux Summary Liberty for Java for IBM Cloud is vulnerable to identity spoofing with the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0 or appSecurity-4.0 feature enabled. This has been addressed. Vulnerability Details CVEID: CVE-2022-22476 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request. IBM X-Force ID: 225604. CVSS Base score: 5 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/ 225604 for the current score. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Affected Products and Versions These vulnerabilities affect all versions of Liberty for Java for IBM Cloud up to and including v3.71. Remediation/Fixes To upgrade to Liberty for Java for IBM Cloud v3.72-20220720-1509 or higher, you must re-stage or re-push your application To find the current version of Liberty for Java for IBM Cloud being used, from the command-line Cloud Foundry client by running the following commands: cf ssh <appname> -c "cat staging_info.yml" Look for similar lines: {"detected_buildpack":"Liberty for Java(TM) (WAR, liberty-xxx, v3.72-20220720-1509, xxx, env)","start_command":".liberty/initial_startup.rb"} To re-stage your application using the command-line Cloud Foundry client, use the following command: cf restage <appname> To re-push your application using the command-line Cloud Foundry client, use the following command: cf push <appname> Workarounds and Mitigations None Change History 08 Aug 2022: Initial Publication - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBYvHQ1MkNZI30y1K9AQjAhA//casteIQAhZff7BKJ0TtNcQm27la+8MC7 nmo3yPuq4hJQrp2Vg3n5JJoXC6qVq1juSvKiXvnqx03jMNGrr7/qO8yJAydUU8fh NuoeFs3y6Dpdn/SEUA2zVCt4isHFYvpKZdReE3Ko3D1KfvqUAm7hV/bcfn1PPbTK 28yrnlK9cWGOROp95v9LeKljASHGlkO3rFKTgPXcjVt/8CIOHszJP5bCpjBzMA3y zUbwZHteWXdIxN3jYImhGrtMU8A2Z5/dLcc4ol4lAX19VPacT1Ye99HjyGIBE4mv bnkrBpJg6z1PG111f6+r/qCDCEHeuCAC2jfJb6qkAIrjDaWZCCIA330T4XRm+Q36 zKpPCVaNJEdt+LrVolukEkkHrBdzFDPr8j2M/st9cWWXOJ0YQ504Altvx9rXDAkf u11pXgUfSkYNprU0PdC8PGf3z680hby8HgSOEU5vN5v+5u+aMD3P219f63c3wQW0 h2fESBlkyDJFjjaHcEMhvreMgoVBKqo/lqgKqbhHoDLlUJX9oNlOWclX+aJYKpUC E9h+LBpAZ0rKlI8I4ovihxLXJCiHxibuMt4e9lO4TxIzCJSPt2CAZjJk7yrBd8of pGUnRi20neYFTxpXpwjHwNdfz5LhwFiyY89Z/LVr4lBv9qwVIX6EzjPotdJ81juz uOll6q5d/7E= =TKAk -----END PGP SIGNATURE-----