CVE-2022-22965 & CVE-2022-22963 vulnerability on NIM

Products

• DX Operational Intelligence
• CA Spectrum
• DX Unified Infrastructure Management (Nimsoft / UIM)
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)
• CA Service Operations Insight (SOI)
• CA Identity Governance
• Application Lifecycle Conductor
• Compliance Event Manager
• Trusted Access Manager for Mainframe

Issue/Introduction

Two vulnerabilities CVE-2022-22965 and CVE-2022-22963 have been reported on Spring
Framework. 

CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+
 A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote
code execution (RCE) via data binding. The specific exploit requires the application to run on
Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar,
i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is
more general, and there may be other ways to exploit it.
 
CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring
Expression
 In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using
routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-
expression that may result in remote code execution and access to local resources.

What is the impact on NIM?
No Impact

Environment

Release: NIM SM 3.2.331

Resolution

Our engineering team has analyzed these vulnerabilities and confirmed that NIM is not
impacted by these vulnerabilities as we are not running our applications on JDK9+ and are
not using Spring Cloud Function libraries.

CVE-2022-22965:
NIM is NOT vulnerable to this zero-day exploit as it ships JRE8.

CVE-2022-22963:
NIM doesn’t use Spring Cloud Foundation library and is NOT vulnerable to this exploit.