Security Bulletin: IBM Storage Protect is vulnerable to a denial of service attack due to Google Gson (CVE-2022-25647)

Summary

IBM Spectrum Protect is uses Google Gson for object serialization and is vulnerable to this attack.

Vulnerability Details

CVEID:CVE-2022-25647
**DESCRIPTION:**Google Gson is vulnerable to a denial of service, caused by the deserialization of untrusted data. By using the writeReplace() method, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 7.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217225 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H)

**IBM X-Force ID:**217225
**DESCRIPTION:**Google Gson is vulnerable to a denial of service, caused by the deserialization of untrusted data. By using the writeReplace() method, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 7.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217225 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H)

Affected Products and Versions

Affected Product(s)|**Version(s)
**
—|—
IBM Storage Protect Server| 8.1

Remediation/Fixes

IBM Storage Protect Server Affected Versions

| Fixing Level|Platform|**Link **to Fix and Instruction
—|—|—|—
8.1.0.000 - 8.1.18.xxx| 8.1.19| AIX Linux Windows| <https://www.ibm.com/support/pages/node/6988821&gt;

Workarounds and Mitigations

None