Critical
VMSA-2022-0010
9.8
2022-04-02
2022-04-02 (Initial Advisory)
CVE-2022-22965
VMware Response to Spring Framework Remote Code Execution Vulnerability, aka Spring4Shell (CVE-2022-22965)
1. Impacted Products
- VMware Tanzu Application Service for VMs
- VMware Tanzu Operations Manager
- VMware Tanzu Kubernetes Grid Integrated Edition (TKGI)
2. Introduction
A critical vulnerability in Spring Framework project (aka Spring4Shell) identified by CVE-2022-22965 has been publicly disclosed which impacts VMware products.
3. Problem Description
Description
Multiple products impacted by remote code execution vulnerability via Spring4Shell (CVE-2022-22965).
Known Attack Vectors
A malicious actor with network access to an impacted VMware product may exploit this issue to gain full control of the target system.
Resolution
Fixes for CVE-2022-22965 are documented in the ‘Fixed Version’ column of the ‘Response Matrix’ below.
Workarounds
Workarounds for CVE-2022-22965 are documented in the ‘Workarounds’ column of the ‘Response Matrix’ below.
Additional Documentation
None.
Notes
At the time of this publication, VMware has reviewed its product portfolio and found that the products listed in this advisory are affected. VMware continues to investigate this vulnerability, and will update the advisory should any changes evolve.
Acknowledgements
None.
Response Matrix
| Product | Version | Running On | CVE Identifier | CVSSv3 | Severity | Fixed Version | Workarounds | Additional Documentation |
Tanzu Application Service for VMs | 2.13 | Any | CVE-2022-22965 | critical
| None | |||
Tanzu Application Service for VMs | 2.12 | Any | CVE-2022-22965 | critical
| None | |||
Tanzu Application Service for VMs | 2.11 | Any | CVE-2022-22965 | critical
| None | |||
Tanzu Application Service | 2.10 | Any | CVE-2022-22965 | critical
| None | |||
Tanzu Operations Manager | 2.10 | Any | CVE-2022-22965 | 9.8 | critical
| None | None | |
Tanzu Operations Manager | 2.9 | Any | CVE-2022-22965 | critical
| None | None | ||
Tanzu Operations Manager | 2.8 | Any | CVE-2022-22965 | critical
| None | None | ||
TKGI | 1.13 | Any | CVE-2022-22965 | critical
| Patch pending | None | ||
TKGI | 1.12 | Any | CVE-2022-22965 | critical
| Patch pending | None | ||
TKGI | 1.11 | Any | CVE-2022-22965 | critical
| Patch pending | None |
4. References
Fixed Version(s) and Release Notes:
Tanzu Application Service
Downloads and Documentation:
https://network.pivotal.io/products/elastic-runtime/
Tanzu Operations Manager
Downloads and Documentation:
https://network.tanzu.vmware.com/products/ops-manager
VMware TKGI
Downloads and Documentation:
https://network.pivotal.io/products/pivotal-container-service/
Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965
FIRST CVSSv3 Calculator:
CVE-2022-22965: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
5. Change Log
2022-04-02 VMSA-2022-0010
Initial security advisory.
6. Contact
E-mail list for product security notifications and announcements:
https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce@lists.vmware.com
E-mail: security@vmware.com
PGP key at:
VMware Security Advisories
https://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
VMware Security & Compliance Blog
https://blogs.vmware.com/security
Copyright 2022 VMware Inc. All rights reserved.
Read full article (vmware.com)
All content and images belong to their respected owners, this article is for informational purposes only.
