UIM - Spring Framework Denial of Service (DoS) Data Binding Vulnerability: cve-2022-22970 and cve-2022-22971

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

 

One of our servers is reporting for the below vulnerability. Could you please suggest the remediation that needs to be applied.

 

 cve-2022-22970 and cve-2022-22971

 

Spring Framework Denial of Service (DoS) Data Binding Vulnerability:

/opt/nimsoft/probes/slm/baseline_engine/lib/spring-core-5.3.18.jar

/opt/nimsoft/probes/slm/prediction_engine/lib/spring-core-5.3.18.jar

 

 

Environment

Release : 20.4

Resolution

The resolution is included in UIM 20.4CU8 or later. Please upgrade the UIM to the latest CU version.

From the description of these vulnerabilities there is no impact to baseline_engine or prediction_engine based on intended use for which the vulnerability can occur. 

CVE-2022-22970

In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

CVE-2022-22971

In spring framework versions prior to 5.3.20+, 5.2.22+ and old unsupported versions, applications with a STOMP over WebSocket endpoint are vulnerable to a denial-of-service attack by an authenticated user.

Note: baseline_engine or prediction_engine modules are not vulnerable based on the above description due to their usage.
Also, both these vulnerabilities are present in the medium category.  
However, in the latest CU8 where we are using Spring 5.3.27 version and these vulnerabilities are remediated.

 

Additional Information

As of 26 Aug 2024, UIM 23.4CU2 uses version 5.3.37.