VMSA-2022-0010

Critical

Advisory ID: VMSA-2022-0010.6

CVSSv3 Range: 9.8

Issue Date: 2022-04-02

Updated On: 2022-04-30

CVE(s): CVE-2022-22965

Synopsis: VMware Response to Spring Framework Remote Code Execution Vulnerability (CVE-2022-22965)

IMPORTANT See the Notes section if prior to April 6, 3 PM PST you have updated TAS or Ops Manager or you have applied workarounds to TAS, Ops Manager or TKGi.

1. Impacted Products

VMware Tanzu Application Service for VMs (TAS)
VMware Tanzu Operations Manager (Ops Manager)
VMware Tanzu Kubernetes Grid Integrated Edition (TKGI)

2. Introduction

A critical vulnerability in Spring Framework project identified by CVE-2022-22965 has been publicly disclosed which impacts VMware products.

3. Problem Description

Description

Multiple products impacted by remote code execution vulnerability (CVE-2022-22965).

Known Attack Vectors

A malicious actor with network access to an impacted VMware product may exploit this issue to gain full control of the target system.

Resolution

Fixes for CVE-2022-22965 are documented in the 'Fixed Version' column of the 'Response Matrix' below.

Workarounds

Workarounds for CVE-2022-22965 are documented in the 'Workarounds' column of the 'Response Matrix' below.

Additional Documentation

None.

Notes

2022-04-04: At the time of this publication, VMware has reviewed its product portfolio and found that the products listed in this advisory are affected. VMware continues to investigate this vulnerability, and will update the advisory should any changes evolve.
2022-04-06: VMware is aware of reports that exploitation of CVE-2022-22965 has occurred in the wild.
2022-04-06: Customers that have applied the workaround for TAS, Ops Manager, or TKGI prior to April 6, 3 PM PST will need to reapply the workaround. The new workaround instructions now use UAA 74.5.37 which properly addresses CVE-2022-22965.
2022-04-06: Customers that have updated to TAS 2.10.29, 2.11.17, 2.12.10 or 2.13.1 will need to update to the TAS versions listed in this advisory. The patched versions now listed in this advisory ship with UAA 74.5.37 which properly addresses CVE-2022-22965.
2022-04-06: Customers that have updated to Ops Manager 2.8.20, 2.9.35 or 2.10.35 are advised to deploy the workaround as no version for Ops Manager is yet available that addresses CVE-2022-22965.
2022-04-07: Customers that have updated to Ops Manager 2.8.20, 2.9.35 or 2.10.35 will need to update to the Ops Manager versions listed in this advisory. The patched versions now listed in this advisory ship with UAA 74.5.37 which properly addresses CVE-2022-22965.
2022-04-08: Investigations have concluded, and the list of affected VMware products contained in the 'Response Matrix' below is complete.

Acknowledgements

None.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
Tanzu Application Service for VMs	2.13	Any	CVE-2022-22965	9.8	critical	2.13.2	Article Number 14035	None
Tanzu Application Service for VMs	2.12	Any	CVE-2022-22965	9.8	critical	2.12.11	Article Number 14035	None
Tanzu Application Service for VMs	2.11	Any	CVE-2022-22965	9.8	critical	2.11.18	Article Number 14035	None
Tanzu Application Service	2.10	Any	CVE-2022-22965	9.8	critical	2.10.30	Article Number 14035	None
Tanzu Operations Manager	2.10	Any	CVE-2022-22965	9.8	critical	2.10.37	Article Number 14035	None
Tanzu Operations Manager	2.9	Any	CVE-2022-22965	9.8	critical	2.9.36	Article Number 14035	None
Tanzu Operations Manager	2.8	Any	CVE-2022-22965	9.8	critical	2.8.21	Article Number 14035	None
TKGI	1.13	Any	CVE-2022-22965	9.8	critical	1.13.4	KB88102	None
TKGI	1.12	Any	CVE-2022-22965	9.8	critical	1.12.6	KB88102	None
TKGI	1.11	Any	CVE-2022-22965	9.8	critical	1.11.10	KB88102	None

4. References

Fixed Version(s) and Release Notes:

Tanzu Application Service
Downloads and Documentation:
https://network.pivotal.io/products/elastic-runtime/

Tanzu Operations Manager
Downloads and Documentation:
https://network.tanzu.vmware.com/products/ops-manager

VMware TKGI
Downloads and Documentation:
https://network.pivotal.io/products/pivotal-container-service/

TKGI 1.12.5: https://docs.pivotal.io/tkgi/1-12/release-notes.html#1-12-5

TKGI 1.11.10: https://docs.pivotal.io/tkgi/1-11/release-notes.html#1-11-10

Mitre CVE Dictionary Links:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965

FIRST CVSSv3 Calculator:
CVE-2022-22965: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

5. Change Log

2022-04-02 VMSA-2022-0010
Initial security advisory.

2022-04-06 VMSA-2022-0010.1

Updated workaround for Tanzu Operations Manager

2022-04-06 VMSA-2022-0010.2
Added new, patched versions for TAS. Added alert to the Notes section on the need to update versions or reapply the workaround.

2022-04-07 VMSA-2022-0010.3

Added new patched versions of Tanzu Operations Manager.

2022-04-08 VMSA-2022-0010.4

Added note confirming investigations have concluded.

2022-04-14 VMSA-2022-0010.5
Added patched versions for TKGI 1.12 and TKGI 1.11

2022-04-30 VMSA-2022-0010.6
Added patched versions for TKGI 1.13 and new patched version for TKGI 1.12