CVE-2022-22971

This repository does not have a README...

Jira Server/DC impacted by CVE-2022-22970 & CVE-2022-22971 via vulnerable version of Spring framework

Jira is not impacted no action is required as the vulnerability +cannot be exploited+. All Jira versions below 9.6 uses an affected version of Spring Framework, reason why the JRASERVER-74776 was published, however Jira +does not use the affected methods from the Spring+, hence +is not impacted+:...

Vulnerabilities fixed in Oracle Siebel CRM

Vulnerabilities have been fixed in Oracle Siebel CRM. The vulnerabilities allow a malicious party to conduct attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Access to sensitive data Oracle has fixed vulnerabilities in the...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to a denial of service due to Vmware Tanzu Spring Framework (CVE-2022-22971)

Summary IBM Sterling Partner Engagement Manager uses Vmware Tanzu Spring Framework that is vulnerable to a denial of service, caused by a flaw with a STOMP over WebSocket endpoint. The issue has been addressed. Vulnerability Details CVEID:CVE-2022-22971 DESCRIPTION: Vmware Tanzu Spring Framework ...

Security Bulletin: Rational Test Control Panel component in Rational Test Virtualization Server and Rational Test Workbench is vulnerable to a denial of service attack in Spring Framework (CVE-2022-22971)

Summary Spring Framework is vulnerable to a security issue affecting Rational Test Control Panel Vulnerability Details CVEID:CVE-2022-22971 DESCRIPTION: Vmware Tanzu Spring Framework is vulnerable to a denial of service, caused by a flaw with a STOMP over WebSocket endpoint. By sending a...

Security Bulletin: IBM Sterling Control Center is vulnerable to denial of service by authenticated user due to Spring Framework (CVE-2022-22971)

Summary Spring Framework is vulnerable to a denial of service, caused by a flaw with a STOMP over WebSocket endpoint. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition. IBM Sterling Control Center uses...

Security Bulletin: IBM Common Licensing is vulnerable by a remote code attack in Spring Framework and Apache Commons(CVE-2022-22970,CVE-2022-22971,CVE-2022-33980)

Summary IBM Common Licensing is vulnerable to a remote code execution in Spring Framework CVE-2022-22970,CVE-2022-22971 as it does have Spring Framework versions 5.3.0 to 5.3.20, 5.2.0 to 5.2.22, and older versions. IBM Common Licensing is vulnerable to a remote code execution in Apache Commons...

Security Bulletin: Watson Machine Learning Accelerator is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22971)

Summary Watson Machine Learning Accelerator is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22971 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast t...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Spring Framework

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Spring Framework. Vulnerability Details CVEID:CVE-2022-22971 DESCRIPTION: Vmware Tanzu Spring Framework is vulnerable to a denial of service, caused by a flaw with a STOMP over WebSocket endpoint. By sending ...

com.github.zed-platform:zed-service-messagestore-attachment (0.0.20), com.northstrat:springsecurity3-websockets (0.1) +53 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.1.5.release)

org.springframework:spring-messaging MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.github.zed-platform:zed-service-messagestore-attachment 0.0.20 -...

ch.rasc:wampspring (1.1.1), ch.rasc:wampspring-security (1.1.1) +144 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.1.6.release)

org.springframework:spring-messaging MAVEN version 4.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - ch.rasc:wampspring 1.1.1 - ch.rasc:wampspring-security 1.1.1 -...

io.bitsensor:lib-util (4.11.0), io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.6.4, <=5.7.0) +70 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.23.release)

org.springframework:spring-messaging MAVEN version 4.3.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - io.bitsensor:lib-util 4.11.0 -...

com.blitline:blitline-image-client-spring (>=0.10.1, <=0.12.0) potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.0.4.release)

org.springframework:spring-messaging MAVEN version 4.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.blitline:blitline-image-client-spring =0.10.1, =0.12.0 Source cves:...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.24), br.com.itsme:commons (>=0.0.4-alpha, <=0.0.5-alpha) +3354 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (>=5.0.0.release, <=5.2.21.release)

org.springframework:spring-messaging MAVEN version =5.0.0.release, =0.5.0, =0.0.4-alpha, =3.4.0, =4.1.0, =4.1.0, =3.6.0, =5.2.0, =5.1.0, =3.1.0, =5.1.0, =3.5.0, =5.1.0, =5.1.0, =4.0.0, =3.7.0, =5.2.1 and more Source cves: CVE-2022-22971 Source advisory: OSV:GHSA-RQPH-VQWM-22VC...

org.springframework.boot:spring-boot-starter-integration (>=1.1.9.release, <=1.1.10.release), org.springframework.integration:spring-integration-amqp (>=4.0.6.release, <=4.0.7.release) +27 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.0.8.release)

org.springframework:spring-messaging MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.springframework.boot:spring-boot-starter-integration =1.1.9.release,...

de.mhus.app.vault:vault-playground-assembly (>=7.2.0, <=7.3.0), de.mhus.cherry.vault:vault-playground-assembly (7.1.0) +45 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.26.release)

org.springframework:spring-messaging MAVEN version 4.3.26.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - de.mhus.app.vault:vault-playground-assembly =7.2.0, =7.1.0, =7.1.0, =7.1.0,...

com.savoirtech.aetos:aetos (4.3.0), de.mhus.app.vault:vault-playground-assembly (7.7.0) +60 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.30.release)

org.springframework:spring-messaging MAVEN version 4.3.30.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.savoirtech.aetos:aetos 4.3.0 - de.mhus.app.vault:vault-playground-assembly...

io.bitsensor:lib-util (>=4.6.0, <=4.8.0), net.jade-dungeon:javautils-dao (>=0.1.19, <=0.1.20) +22 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.21.release)

org.springframework:spring-messaging MAVEN version 4.3.21.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - io.bitsensor:lib-util =4.6.0, =0.1.19, =0.1.20 -...

ca.jeb:common-java (2014.10.01), ca.jeb:protobuf-serializer (2014.10.01) +69 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.0.7.release)

org.springframework:spring-messaging MAVEN version 4.0.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - ca.jeb:common-java 2014.10.01 - ca.jeb:protobuf-serializer 2014.10.01 -...

org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms (>=4.1.0.release_1, <=4.1.0.release_5), org.jiucai:appframework (2.0.0) +2 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.1.0.release)

org.springframework:spring-messaging MAVEN version 4.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms...