Security Bulletin: Code injection vulnerability affect IBM Business Automation Workflow (CVE-2022-42920)

2023-01-0916:57:44

www.ibm.com

ibm business automation workflow

code injection

vulnerability

apache commons bcel

remote attacker

security restrictions

out-of-bounds write flaw

cvss base score 9.8

cve-2022-42920

interim fix

cumulative fix

apar dt174250

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.019

Percentile

88.8%

JSON

Summary

IBM Business Automation Workflow packages Apache Commons BCEL. A code injection vulnerability affecting BCEL was reported. (CVE-2022-42920)

Vulnerability Details

CVEID:CVE-2022-42920
**DESCRIPTION:**Apache Commons BCEL could allow a remote attacker to bypass security restrictions, caused by an out-of-bounds write flaw in the APIs. By sending a specially-crafted request, an attacker could exploit this vulnerability to gain control over the resulting bytecode than otherwise expected.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239562 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)	Status
IBM Business Automation Workflow containers	V22.0.2	not affected
IBM Business Automation Workflow containers	V22.0.1 - V22.0.1-IF005
V21.0.3 - V21.0.3-IF015
V21.0.2 all fixes
V20.0.0.2 all fixes
V20.0.0.1 all fixes	affected
IBM Business Automation Workflow traditional	V22.0.2	not affected
IBM Business Automation Workflow traditional	V22.0.1
V21.0.1 - V21.0.3.1
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3	affected

For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.

Remediation/Fixes

The recommended solution is to apply the Interim Fix (iFix) or Cumulative Fix (CF) containing APAR DT174250 as soon as practical.

Affected Product(s)	Version(s)	Remediation / Fix
IBM Business Automation Workflow containers	V22.0.1	Apply 22.0.1-IFT006
IBM Business Automation Workflow containers	V21.0.3	Apply 21.0.3-IF016
or upgrade to 22.0.1-IFT006 or later
IBM Business Automation Workflow containers	V21.0.2
V20.0.0.1 - V20.0.0.2	Upgrade to 21.0.3-IF016
or upgrade to 22.0.1-IFT006 or later
IBM Business Automation Workflow traditional	V22.0.1	Apply DT174250
IBM Business Automation Workflow traditional	V21.0.3	Apply DT174250
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT174250
IBM Business Automation Workflow traditional	V21.0.2	Upgrade to IBM Business Automation Workflow 21.0.3.1 and apply DT174250
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT174250
IBM Business Automation Workflow traditional	V20.0.0.2	Apply DT174250
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT174250
IBM Business Automation Workflow traditional	V20.0.0.1	Upgrade to IBM Business Automation Workflow v20.0.0.2 and apply DT174250
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT174250
IBM Business Automation Workflow traditional	V19.0.0.3	Apply DT174250
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT174250
IBM Business Automation Workflow traditional	V19.0.0.1 - V19.0.0.2	Upgrade to IBM Business Automation Workflow 19.0.0.3 and apply DT174250
or upgrade to IBM Business Automation Workflow 22.0.1 or later and apply DT174250