search cancel

Impact of CVE-2022-22965 and CVE-2022-22963 on TDM

book

Article ID: 238436

calendar_today

Updated On:

Products

CA Test Data Manager (Data Finder / Grid Tools)

Issue/Introduction

Two vulnerabilities CVE-2022-22965 and CVE-2022-22963 have been reported on Spring Framework. 

CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+

 A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
 

CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring Expression

 In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

What is the impact on Test Data Manager?

Environment

Release : 4.10, 4.9.1, 4.9, 4.8,1, 4.8

Component : Test Data Manager - Other

Resolution

Our engineering team has analyzed these vulnerabilities and confirmed that TDM is not impacted by these vulnerabilities as we are not running our applications on JDK9+ and are not using Spring Cloud Function libraries.

CVE-2022-22965:
Test Data Manager is NOT vulnerable to this zero-day exploit as it ships JRE8.

CVE-2022-22963:
Test Data Manager doesn’t use Spring Cloud Foundation library and is NOT vulnerable to this exploit.