Is there any impact of vulnerability CVE-2022-42889 on Advanced Authentication?

Products

• CA Advanced Authentication - Strong Authentication (AuthMinder / WebFort)
• CA Advanced Authentication
• CA Risk Authentication

Issue/Introduction

AA 9.1.02 is using/shipping Apache Commons Text 1.9. Is AA vulnerable The  CVE-2022-42889 eludes to remote code execution or unintentional contact with remote servers. Is AA vulnerable?

 

Please refer to these two related links 

 

1. https://nvd.nist.gov/vuln/detail/CVE-2022-42889

2. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42889

 

 

 

Environment

Release : 9.1

Resolution

CVE-2022-42889:

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers.

Impact on Advanced Authentication:

Advanced Authentication product team has completed the analysis and determined that we are not vulnerable to CVE-2022-42889. This because, AA is not using vulnerable Apache commons text jar in any processing.

Additional Information

Symantec Products Advisory can be found here:

Symantec Security Advisory for Apache Commons Text CVE-2022-42889