CVE-2022-42889 and Workload Automation Dseries

Products

• CA Workload Automation DE - Scheduler (dSeries)
• CA Workload Automation DE - System Agent (dSeries)

Issue/Introduction

CVE-2022-42889 was published in the National Vulnerability Database on 13 October, 2022.  More information can be found here. 

The vulnerability is caused with the use of Apache Commons Text 1.5 through 1.9.  

1. Is Workload Automation Dseries impacted?
2. Are agents impacted?

Environment

Release: All Supported Versions
Component: Workload Automation Dseries & Workload Automation System Agents

Resolution

1. None of the components in DE uses the Apache commons text, hence DE not affected.
2. Agents also do not use Apache commons text, so no impact here either.

As per the above, no actions are necessary on either DE or Agents.