Security Bulletin: IBM Security Verify Information Queue web-app container is vulnerable to denial of service attack (CVE-2022-35283)

Summary The web-app container in IBM Security Verify Information Queue ISIQ v10.0.2 can be shut down with a malformed HTTP request. ISIQ v10.0.3 has implemented stricter URL validation to prevent this type of denial of service attack. CVE-2022-35283 Vulnerability Details CVEID:CVE-2022-35283...

com.axway.ats.distrib:ats-distrib (>=4.0.7, <=4.0.8), com.axway.ats.framework.utilities:ats-azure-utilities (>=4.0.7, <=4.0.8) +187 more potentially affected by CVE-2022-30187 via com.azure:azure-storage-blob (>=12.0.0, <=12.18.0-beta.1)

com.azure:azure-storage-blob MAVEN version =12.0.0, =4.0.7, =4.0.7, =3.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =4.0.0-beta.2, =4.0.0-beta.2, =4.0.0-beta.2, =4.0.0-beta.2, =4.0.0-beta.2, =4.0.0-beta.2, =4.0.0-beta.2, =1.0.0-beta.4, =1.13.0 and more Source cves: CVE-2022...

ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter (>=0.1.6, <=0.1.7), ai.foremast.metrics:foremast-spring-boot-k8s-metrics-starter (>=0.1.4-sb1x, <=0.1.4-sb1x_6) +324 more potentially affected by CVE-2022-27772 via org.springframework.boot:spring-boot (1.3.0.release)

org.springframework.boot:spring-boot MAVEN version 1.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - ai.foremast.metrics:foremast-spring-boot-1x-k8s-metrics-starter =0.1.6,...

org.springframework.boot:spring-boot-actuator (1.1.10.release), org.springframework.boot:spring-boot-autoconfigure (1.1.10.release) +30 more potentially affected by CVE-2022-27772 via org.springframework.boot:spring-boot (1.1.10.release)

org.springframework.boot:spring-boot MAVEN version 1.1.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot and may be impacted: - org.springframework.boot:spring-boot-actuator 1.1.10.release -...

com.lframework:cloud-starter (>=3.1.0, <=4.1.1), com.yomahub:liteflow-rule-nacos (>=2.9.1, <=2.16.3.1) +7 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.4.4)

com.alibaba.nacos:nacos-client MAVEN version 1.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.lframework:cloud-starter =3.1.0, =2.9.1, =1.0.0-release, =1.0.2, =1.0.1, =1.10.5-m1, =1.10.2-m2...

org.nutz:nutzboot-starter-nacos-config-client (>=2.3.1.v20190318, <=2.3.7.v20190731) potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.9.0)

com.alibaba.nacos:nacos-client MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - org.nutz:nutzboot-starter-nacos-config-client =2.3.1.v20190318, =2.3.7.v20190731 Source cves:...

com.alibaba.csp:sentinel-datasource-nacos (0.2.0), com.alibaba.csp:sentinel-demo-nacos-datasource (0.2.0) +3 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.2.0)

com.alibaba.nacos:nacos-client MAVEN version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 0.2.0 - com.alibaba.csp:sentinel-demo-nacos-datasource...

com.alibaba:dubbo-registry-nacos (0.0.1), com.alipay.sofa:rpc-sofa-boot-core (>=5.5.0, <=6.0.1) +2 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.6.0)

com.alibaba.nacos:nacos-client MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.alibaba:dubbo-registry-nacos 0.0.1 - com.alipay.sofa:rpc-sofa-boot-core =5.5.0, =5.5.0, =5.5.0,...

com.github.hengboy:micro-job-autoconfigure (0.0.3.release), com.github.hengboy:micro-job-registry-nacos (0.0.3.release) +9 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.8.2)

com.alibaba.nacos:nacos-client MAVEN version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.github.hengboy:micro-job-autoconfigure 0.0.3.release -...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.3, <=0.2.3), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.3, <=0.2.3) +63 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (1.1.3)

com.alibaba.nacos:nacos-client MAVEN version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.3, =0.1.3, =2.7.7, =1.0.0, =1.0.0, =1.0.0,...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.0-rc1, <=0.2.1), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.0-rc1, <=0.2.1) +3 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (0.2.1-rc1)

com.alibaba.nacos:nacos-client MAVEN version 0.2.1-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-client and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.0-rc1, =0.1.0-rc1, =0.1.0-rc1, =0.1.0-rc...

com.groupon.jenkins-ci.plugins:dotci (>=2.10.0, <=2.28.1), com.groupon.jenkins-ci.plugins:dotci-dockerpublish (>=1.0.0, <=1.0.3) +8 more potentially affected by CVE-2022-34171 via org.jenkins-ci.main:jenkins-core (1.618)

org.jenkins-ci.main:jenkins-core MAVEN version 1.618 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =2.10.0, =1.0.0, =1.1.3, =1.7.2, =1.3.0, =1.0.0, =1.0, =1....

com.groupon.jenkins-ci.plugins:dotci (>=2.10.0, <=2.28.1), com.groupon.jenkins-ci.plugins:dotci-dockerpublish (>=1.0.0, <=1.0.3) +8 more potentially affected by CVE-2022-34174 via org.jenkins-ci.main:jenkins-core (1.618)

org.jenkins-ci.main:jenkins-core MAVEN version 1.618 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.groupon.jenkins-ci.plugins:dotci =2.10.0, =1.0.0, =1.1.3, =1.7.2, =1.3.0, =1.0.0, =1.0, =1....

org.craftercms:crafter-social (2.3.6), org.grails:gorm-mongodb-spring-boot (>=1.0.0.rc2, <=1.0.0.release) +7 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.4.2.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.craftercms:crafter-social 2.3.6 -...

de.digitalcollections:iiif-bookshelf-webapp (>=2.3.1, <=2.5.1), io.gumga:gumga-application (>=1.5.23, <=4.0.4) +3 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.10.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.10.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - de.digitalcollections:iiif-bookshelf-webapp =2.3.1, =1.5.23,...

org.springframework.boot:spring-boot-starter-data-mongodb (2.1.14.release), org.springframework.boot:spring-boot-starter-data-mongodb-reactive (2.1.14.release) +2 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.1.17.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.17.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.boot:spring-boot-starter-data-mongodb...

org.springframework.boot:spring-boot-starter-data-mongodb (2.1.11.release), org.springframework.boot:spring-boot-starter-data-mongodb-reactive (2.1.11.release) +3 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.1.14.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.14.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.boot:spring-boot-starter-data-mongodb...

org.springframework.boot:spring-boot-starter-data-mongodb (2.1.16.release), org.springframework.boot:spring-boot-starter-data-mongodb-reactive (2.1.16.release) +3 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.1.19.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.19.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.boot:spring-boot-starter-data-mongodb...

org.springframework.boot:spring-boot-starter-data-mongodb (2.1.15.release), org.springframework.boot:spring-boot-starter-data-mongodb-reactive (2.1.15.release) +2 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.1.18.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.boot:spring-boot-starter-data-mongodb...

org.springframework.boot:spring-boot-starter-data-mongodb (1.4.4.release), org.springframework.data:spring-data-mongodb-cross-store (1.9.7.release) potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (1.9.7.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.9.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.boot:spring-boot-starter-data-mongodb...