Security Bulletin: Vulnerabilities in IBM Java Runtime and IBM WebSphere Application Server Liberty affect IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments

Summary

IBM Spectrum Protect Backup-Archive Client, IBM Spectrum Protect for Space Management, and IBM Spectrum Protect for Virtual Environments may be affected by the below IBM Java and IBM WebSphere Application Server Liberty vulnerabilities (CVEs).

Vulnerability Details

CVEID:CVE-2022-22476
**DESCRIPTION:**IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.7 and Open Liberty are vulnerable to identity spoofing by an authenticated user using a specially crafted request. IBM X-Force ID: 225604.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225604 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)

CVEID:CVE-2022-21496
**DESCRIPTION:**An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to cause no confidentiality impact, low integrity impact, and no availability impact.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/224777 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2022-22475
**DESCRIPTION:**IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated user. IBM X-Force ID: 225603.
CVSS Base score: 7.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225603 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L)

Affected Products and Versions

Remediation/Fixes

_IBM Spectrum Protect Backup-Archive Client Affected Versions
_|Fixing
Level|Platform|_Link to Fix and Instructions
_
—|—|—|—
8.1.9.0-8.1.15.1 (AIX)
8.1.7.0-8.1.15.1 (Linux)
8.1.0.0-8.1.15.1 (Macintosh)
8.1.0.0-8.1.15.1 (Windows)
| 8.1.15.2| AIX*****
Linux*****
Macintosh
Windows| <https://www.ibm.com/support/pages/node/6593819&gt;

***** The AIX and Linux platforms are only affected if using the web user interface.

_IBM Spectrum Protect for
Space Management Affected Versions
_|Fixing
Level|Platform|_Link to Fix and Instructions
_
—|—|—|—
8.1.9.0-8.1.15.1 (AIX)
8.1.7.0-8.1.15.1 (Linux)
| 8.1.15.2| AIX
Linux| <https://www.ibm.com/support/pages/node/316077&gt;

_IBM Spectrum Protect for
Virtual Environments:
Data Protection for VMware
Affected Versions
_|Fixing
Level|Platform|_Link to Fix and Instructions
_
—|—|—|—
8.1.0.0-8.1.15.1 (Linux)
8.1.0.0-8.1.15.1 (Windows| 8.1.15.2| Linux
Windows| <https://www.ibm.com/support/pages/node/6568701&gt;

_IBM Spectrum Protect for
Virtual Environments:
Data Protection for Hyper-V Affected Versions
_|Fixing
Level|Platform|_Link to Fix and Instructions
_
—|—|—|—
8.1.0.0-8.1.15.1 (Windows)| 8.1.15.2| Windows| <https://www.ibm.com/support/pages/node/6568701&gt;

Workarounds and Mitigations

None