CVE-2022-22971

This repository does not have a README...

Jira Server/DC impacted by CVE-2022-22970 & CVE-2022-22971 via vulnerable version of Spring framework

Jira is not impacted no action is required as the vulnerability +cannot be exploited+. All Jira versions below 9.6 uses an affected version of Spring Framework, reason why the JRASERVER-74776 was published, however Jira +does not use the affected methods from the Spring+, hence +is not impacted+:...

Vulnerabilities fixed in Oracle Siebel CRM

Vulnerabilities have been fixed in Oracle Siebel CRM. The vulnerabilities allow a malicious party to conduct attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Manipulation of data Access to sensitive data Oracle has fixed vulnerabilities in the...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to a denial of service due to Vmware Tanzu Spring Framework (CVE-2022-22971)

Summary IBM Sterling Partner Engagement Manager uses Vmware Tanzu Spring Framework that is vulnerable to a denial of service, caused by a flaw with a STOMP over WebSocket endpoint. The issue has been addressed. Vulnerability Details CVEID:CVE-2022-22971 DESCRIPTION: Vmware Tanzu Spring Framework ...

Security Bulletin: Rational Test Control Panel component in Rational Test Virtualization Server and Rational Test Workbench is vulnerable to a denial of service attack in Spring Framework (CVE-2022-22971)

Summary Spring Framework is vulnerable to a security issue affecting Rational Test Control Panel Vulnerability Details CVEID:CVE-2022-22971 DESCRIPTION: Vmware Tanzu Spring Framework is vulnerable to a denial of service, caused by a flaw with a STOMP over WebSocket endpoint. By sending a...

Security Bulletin: IBM Sterling Control Center is vulnerable to denial of service by authenticated user due to Spring Framework (CVE-2022-22971)

Summary Spring Framework is vulnerable to a denial of service, caused by a flaw with a STOMP over WebSocket endpoint. By sending a specially-crafted request, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition. IBM Sterling Control Center uses...

Security Bulletin: IBM Common Licensing is vulnerable by a remote code attack in Spring Framework and Apache Commons(CVE-2022-22970,CVE-2022-22971,CVE-2022-33980)

Summary IBM Common Licensing is vulnerable to a remote code execution in Spring Framework CVE-2022-22970,CVE-2022-22971 as it does have Spring Framework versions 5.3.0 to 5.3.20, 5.2.0 to 5.2.22, and older versions. IBM Common Licensing is vulnerable to a remote code execution in Apache Commons...

Security Bulletin: Watson Machine Learning Accelerator is affected but not classified as vulnerable by a remote code execution in Spring Framework (CVE-2022-22971)

Summary Watson Machine Learning Accelerator is affected but not classified as vulnerable to a remote code execution in Spring Framework CVE-2022-22971 as it does not meet all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast t...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Spring Framework

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Spring Framework. Vulnerability Details CVEID:CVE-2022-22971 DESCRIPTION: Vmware Tanzu Spring Framework is vulnerable to a denial of service, caused by a flaw with a STOMP over WebSocket endpoint. By sending ...

ai.superstream:spring-kafka (>=2.8.4-alpha1, <=2.8.4-alpha6), biz.eyebeam.mssc:mssc-public-bom (>=1.0.1, <=1.0.5) +2369 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (>=5.3.0, <=5.3.19)

org.springframework:spring-messaging MAVEN version =5.3.0, =2.8.4-alpha1, =1.0.1, =1.0.3, =0.0.1-alpha, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =5.6.5, =5.6.5, =5.3.0, =5.6.5, =5.3.0, =5.3.0, =6.0.5 and more Source cves: CVE-2022-22971 Source advisory: GHSA-RQPH-VQWM-22VC...

com.github.zed-platform:zed-service-messagestore-attachment (0.0.20), com.northstrat:springsecurity3-websockets (0.1) +53 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.1.5.release)

org.springframework:spring-messaging MAVEN version 4.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.github.zed-platform:zed-service-messagestore-attachment 0.0.20 -...

org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms (4.3.28.release_1), org.springframework.integration:spring-integration-amqp (4.3.23.release) +32 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.28.release)

org.springframework:spring-messaging MAVEN version 4.3.28.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - org.apache.servicemix.bundles:org.apache.servicemix.bundles.spring-jms...

com.savoirtech.aetos:aetos (4.3.0), de.mhus.app.vault:vault-playground-assembly (7.7.0) +60 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.30.release)

org.springframework:spring-messaging MAVEN version 4.3.30.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.savoirtech.aetos:aetos 4.3.0 - de.mhus.app.vault:vault-playground-assembly...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.24), br.com.itsme:commons (>=0.0.4-alpha, <=0.0.5-alpha) +3354 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (>=5.0.0.release, <=5.2.21.release)

org.springframework:spring-messaging MAVEN version =5.0.0.release, =0.5.0, =0.0.4-alpha, =3.4.0, =4.1.0, =4.1.0, =3.6.0, =5.2.0, =5.1.0, =3.1.0, =5.1.0, =3.5.0, =5.1.0, =5.1.0, =4.0.0, =3.7.0, =5.2.1 and more Source cves: CVE-2022-22971 Source advisory: OSV:GHSA-RQPH-VQWM-22VC...

com.ahome-it:ahome-tooling-server-core (>=1.1.19-release, <=1.1.26-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.23-release, <=1.1.25-release) +209 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.4.release)

org.springframework:spring-messaging MAVEN version 4.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.19-release, =1.1.23-release,...

cn.springcloud.gray:spring-cloud-gray-client (>=a.1.0.0, <=2.1.0), cn.springcloud.gray:spring-cloud-gray-client-netflix (>=a.1.0.0, <=2.1.0) +392 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.9.release)

org.springframework:spring-messaging MAVEN version 4.3.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - cn.springcloud.gray:spring-cloud-gray-client =a.1.0.0, =a.1.0.0, =a.1.0.0,...

br.jus.stf.digital:core (>=2.0.0, <=2.3.1), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.4, <=2.5) +325 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.7.release)

org.springframework:spring-messaging MAVEN version 4.3.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - br.jus.stf.digital:core =2.0.0, =2.4, =1.1.0, =1.1.0, =1.0.1-release,...

at.researchstudio.sat:won-core (>=0.4, <=0.9), at.researchstudio.sat:won-cryptography (>=0.4, <=0.6) +444 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.18.release)

org.springframework:spring-messaging MAVEN version 4.3.18.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - at.researchstudio.sat:won-core =0.4, =0.4, =0.4, =0.4, =0.4, =0.4, =0.4, =0.4,...

io.bitsensor:lib-util (>=4.9.0, <=4.10.0), io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.6.1, <=5.6.3) +76 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.22.release)

org.springframework:spring-messaging MAVEN version 4.3.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - io.bitsensor:lib-util =4.9.0, =5.6.1, =3.2.8, =1.10.0, =1.10.0,...

com.17jee:e-basic-data (>=3.0.1.5, <=3.0.1.11), com.ahome-it:ahome-tooling-server-core (>=1.1.27-release, <=1.1.31-release) +139 more potentially affected by CVE-2022-22971 via org.springframework:spring-messaging (4.3.5.release)

org.springframework:spring-messaging MAVEN version 4.3.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-messaging and may be impacted: - com.17jee:e-basic-data =3.0.1.5, =1.1.27-release, =1.1.27-release,...