topic Qlik Visibility - Spring Framework vulnerability CVE-2022-22965 in Qlik Replicate

Qlik Visibility - Spring Framework vulnerability CVE-2022-22965

Vikki — Thu, 05 May 2022 16:49:37 GMT

Looking for guidance on Attunity Visibility software v7.3 impact for Spring Framework vulnerability CVE-2022-22965. PNC Security has requested remediation as per below:

Spring Framework contains a flaw in the CachedIntrospectionResults class in spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java related to insecure introspection when using request parameter binding. This may allow a remote attacker to invoke arbitrary Java class methods and execute arbitrary code.

I've found the reference in your support documentation for the subject CVE vulnerability but there is no mention of Qlik Visibility software. Would appreciate some help.

Using:

Operating System: Linux
Operating System Version: RHEL 7.9
Product Release: V7.3
Environment Type: Production

Thank you,
Vikki Turner

Re: Qlik Visibility - Spring Framework vulnerability CVE-2022-22965

lyka — Thu, 05 May 2022 17:03:01 GMT

Good Day!

Visibility is a retired product and no longer supported

https://community.qlik.com/t5/Support-Updates-Blog/Retirement-of-legacy-Attunity-products-on-January-31-2022/ba-p/1732910

Thanks

Lyka

Re: Qlik Visibility - Spring Framework vulnerability CVE-2022-22965

Nanda_Ravindra — Tue, 17 May 2022 16:45:40 GMT

Hello @Vikki

The spring Framework vulnerability listed here is more involved and would probably require code changes. Since the product has reached end of life, I am not sure if R&D can rebuild installation kit for you with the fix. That being said, I am checking with development team on this to see if we can help you in anyway. So, give me some time and I'll get back to you on this.

Thanks,

Nanda

Re: Qlik Visibility - Spring Framework vulnerability CVE-2022-22965

Nanda_Ravindra — Wed, 01 Jun 2022 03:32:19 GMT

@Vikki I checked with the R&D team, and they did confirm that it needs a code rebuild and since the product has reached the end of life, we won't be able to build the code and share the new build.

https://community.qlik.com/t5/Support-Updates-Blog/Retirement-of-legacy-Attunity-products-on-January-31-2022/ba-p/1732910

Thanks,

Nanda