Critical

VMSA-2022-0010.6
9.8
2022-04-02
2022-04-30
CVE-2022-22965
VMware Response to Spring Framework Remote Code Execution Vulnerability (CVE-2022-22965)

Share this page on social media

Sign up for Security Advisories

IMPORTANT See the Notes section if prior to April 6, 3 PM PST you have updated TAS or Ops Manager or you have applied workarounds to TAS, Ops Manager or TKGi.

1. Impacted Products
  • VMware Tanzu Application Service for VMs (TAS)
  • VMware Tanzu Operations Manager (Ops Manager)
  • VMware Tanzu Kubernetes Grid Integrated Edition (TKGI)
2. Introduction

A critical vulnerability in Spring Framework project identified by CVE-2022-22965 has been publicly disclosed which impacts VMware products.

3. Problem Description

Description

Multiple products impacted by remote code execution vulnerability (CVE-2022-22965).

Known Attack Vectors

A malicious actor with network access to an impacted VMware product may exploit this issue to gain full control of the target system.

Resolution

Fixes for CVE-2022-22965 are documented in the 'Fixed Version' column of the 'Response Matrix' below.

Workarounds

Workarounds for CVE-2022-22965 are documented in the 'Workarounds' column of the 'Response Matrix' below.

Additional Documentation

None.

Notes

  • 2022-04-04: At the time of this publication, VMware has reviewed its product portfolio and found that the products listed in this advisory are affected. VMware continues to investigate this vulnerability, and will update the advisory should any changes evolve.
  • 2022-04-06: VMware is aware of reports that exploitation of CVE-2022-22965 has occurred in the wild.
    2022-04-06: Customers that have applied the workaround for TAS, Ops Manager, or TKGI prior to April 6, 3 PM PST will need to reapply the workaround. The new workaround instructions now use UAA 74.5.37 which properly addresses CVE-2022-22965.
  • 2022-04-06: Customers that have updated to TAS 2.10.29, 2.11.17, 2.12.10 or 2.13.1 will need to update to the TAS versions listed in this advisory. The patched versions now listed in this advisory ship with UAA 74.5.37 which properly addresses CVE-2022-22965.
  • 2022-04-06: Customers that have updated to Ops Manager 2.8.20, 2.9.35 or 2.10.35 are advised to deploy the workaround as no version for Ops Manager is yet available that addresses CVE-2022-22965.
  • 2022-04-07: Customers that have updated to Ops Manager 2.8.20, 2.9.35 or 2.10.35 will need to update to the Ops Manager versions listed in this advisory. The patched versions now listed in this advisory ship with UAA 74.5.37 which properly addresses CVE-2022-22965.
  • 2022-04-08: Investigations have concluded, and the list of affected VMware products contained in the 'Response Matrix' below is complete.

 

Acknowledgements

None.

Response Matrix

Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version Workarounds Additional Documentation
Tanzu Application Service for VMs
2.13
Any
CVE-2022-22965
critical
2.13.2
None
Tanzu Application Service for VMs
2.12
Any
CVE-2022-22965
critical
2.12.11
None
Tanzu Application Service for VMs
2.11
Any
CVE-2022-22965
critical
2.11.18
None
Tanzu Application Service
2.10
Any
CVE-2022-22965
critical
2.10.30
None
Tanzu Operations Manager
2.10
Any
CVE-2022-22965
critical
2.10.37
None
Tanzu Operations Manager
2.9
Any
CVE-2022-22965
critical
2.9.36
None
Tanzu Operations Manager
2.8
Any
CVE-2022-22965
critical
2.8.21
None
TKGI
1.13
Any
CVE-2022-22965
critical
1.13.4
None
TKGI
1.12
Any
CVE-2022-22965
critical
None
TKGI
1.11
Any
CVE-2022-22965
critical
None
4. References

Fixed Version(s) and Release Notes:

 

Tanzu Application Service
Downloads and Documentation:
https://network.pivotal.io/products/elastic-runtime/

 

Tanzu Operations Manager
Downloads and Documentation:
https://network.tanzu.vmware.com/products/ops-manager

 

VMware TKGI
Downloads and Documentation:
https://network.pivotal.io/products/pivotal-container-service/

TKGI 1.12.5: https://docs.pivotal.io/tkgi/1-12/release-notes.html#1-12-5

TKGI 1.11.10: https://docs.pivotal.io/tkgi/1-11/release-notes.html#1-11-10

 

Mitre CVE Dictionary Links:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965

 

FIRST CVSSv3 Calculator:
CVE-2022-22965: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

5. Change Log

2022-04-02 VMSA-2022-0010
Initial security advisory.

 

2022-04-06 VMSA-2022-0010.1

Updated workaround for Tanzu Operations Manager

 

2022-04-06 VMSA-2022-0010.2
Added new, patched versions for TAS. Added alert to the Notes section on the need to update versions or reapply the workaround.

 

2022-04-07 VMSA-2022-0010.3

Added new patched versions of Tanzu Operations Manager.

 

2022-04-08 VMSA-2022-0010.4

Added note confirming investigations have concluded.

 

2022-04-14 VMSA-2022-0010.5
Added patched versions for TKGI 1.12 and TKGI 1.11

 

2022-04-30 VMSA-2022-0010.6
Added patched versions for TKGI 1.13 and new patched version for TKGI 1.12

6. Contact

E-mail list for product security notifications and announcements:

https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce 

 

This Security Advisory is posted to the following lists:  

security-announce@lists.vmware.com  

bugtraq@securityfocus.com  

fulldisclosure@seclists.org 

 

E-mail: security@vmware.com

PGP key at:

https://kb.vmware.com/kb/1055 

 

VMware Security Advisories

https://www.vmware.com/security/advisories 

 

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html 

 

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html 

 

VMware Security & Compliance Blog  

https://blogs.vmware.com/security 

 

Twitter

https://twitter.com/VMwareSRC

 

Copyright 2022 VMware Inc. All rights reserved.