Security Bulletin: IBM Liberty for Java for IBM Cloud is vulnerable to server-side request forgery due to Apache CXF (CVE-2022-46364)

Summary

There is a vulnerability in the Apache CXF library used by IBM Liberty for Java for IBM Cloud with the jaxws-2.2 feature enabled. This has been addressed.

Vulnerability Details

CVEID:CVE-2022-46364
**DESCRIPTION:**Apache CXF is vulnerable to server-side request forgery, caused by a flaw in parsing the href attribute of XOP:Include in MTOM requests. By using a specially-crafted request, an attacker could exploit this vulnerability to conduct SSRF attack.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/242008 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

These vulnerabilities affect all versions of Liberty for Java for IBM Cloud up to and including v3.78.

Remediation/Fixes

To upgrade to Liberty for Java for IBM Cloud v3.79-20230223-2310 or higher, you must re-stage or re-push your application

To find the current version of Liberty for Java for IBM Cloud being used, from the command-line Cloud Foundry client by running the following commands:

cf ssh <appname> -c “cat staging_info.yml”

Look for similar lines:

{“detected_buildpack”:“Liberty for Java™ (WAR, liberty-xxx, v3.79-20230223-2310, xxx, env)“,”start_command”:“.liberty/initial_startup.rb”}

For applications using Liberty for Java for IBM Cloud v3.79, follow the instructions below:

To re-stage your application using the command-line Cloud Foundry client, use the following command:

cf set-env <appname> JBP_CONFIG_LIBERTY "version: +"
cf set-env <appname> IBM_LIBERTY_MONTHLY true  
cf restage <appname>

To re-push your application using the command-line Cloud Foundry client, use the following command:

cf set-env <appname> JBP_CONFIG_LIBERTY "version: +"
cf set-env <appname> IBM_LIBERTY_MONTHLY true  
cf push <appname>

For applications using Liberty for Java for IBM Cloud v3.80 or higher, follow the instructions below:

To re-stage your application using the command-line Cloud Foundry client, use the following command:

cf restage <appname>

To re-push your application using the command-line Cloud Foundry client, use the following command:

cf push <appname>

Workarounds and Mitigations

None