topic Re: Vulnerability CVE-2022-22970, CVE-2022-22971 - /replicate/endpoint_srv/externals/spring-core-5.1.9.RELEASE.jar in Qlik Replicate

Vulnerability CVE-2022-22970, CVE-2022-22971 - /replicate/endpoint_srv/externals/spring-core-5.1.9.RELEASE.jar

vijaynarayanan — Wed, 17 Aug 2022 06:54:07 GMT

Hi Team,

Vulnerabilities CVE-2022-22970, CVE-2022-22971 ("Spring Framework Denial of Service (DoS) Data Binding Vulnerability") are detected for the Qlik replicate spring core jar file "/replicate/endpoint_srv/externals/spring-core-5.1.9.RELEASE.jar".

Do we have remediation for the detected vulnerability? We need to update the spring-core jar at the earliest.

Thanks,

~ VJ

Re: Vulnerability CVE-2022-22970, CVE-2022-22971 - /replicate/endpoint_srv/externals/spring-core-5.1.9.RELEASE.jar

Arun_Arasu — Wed, 17 Aug 2022 07:20:06 GMT

Hi @vijaynarayanan

CVE-2022-22970:

This CVE is a DDoS in the Spring file upload function ( a servlet). QDI products do not use this functionality of Spring (Spring is not used in QDI to offer networking services) and thus, there is no actual risk. Qlik will update this component in the 2022.11 release - since no security issue exists, the change is not updated in older releases.

CVE-2022-22971:

This CVE is in Spring's STOMP protocol. QDI products do not use this functionality of Spring and thus, there is no actual risk. Qlik will update this component in the 2022.11 release - since no security issue exists, the change is not updated in older releases.

Re: Vulnerability CVE-2022-22970, CVE-2022-22971 - /replicate/endpoint_srv/externals/spring-core-5.1.9.RELEASE.jar

vijaynarayanan — Wed, 24 Aug 2022 04:46:01 GMT

Team,

Do we have the knowledge base article that explains the same information? I need to update my organization with the details.

Thanks

Re: Vulnerability CVE-2022-22970, CVE-2022-22971 - /replicate/endpoint_srv/externals/spring-core-5.1.9.RELEASE.jar

Arun_Arasu — Wed, 24 Aug 2022 12:42:14 GMT

Hello @vijaynarayanan ,

Unfortunately , there are no knowledge base article that explains the same information.

Regards,

Arun

Re: Vulnerability CVE-2022-22970, CVE-2022-22971 - /replicate/endpoint_srv/externals/spring-core-5.1.9.RELEASE.jar

vijaynarayanan — Wed, 24 Aug 2022 16:45:56 GMT

Hi @Arun_Arasu ,

My Org is looking for the information in knowledge base article to get the exception. Could you guide on the right process to get that information?

Thanks

Re: Vulnerability CVE-2022-22970, CVE-2022-22971 - /replicate/endpoint_srv/externals/spring-core-5.1.9.RELEASE.jar

narendersarva — Wed, 24 Aug 2022 17:49:22 GMT

Hello @vijaynarayanan ,

I checked again but as Arun mentioned, no one has created knowledge base article yet on Vulnerability CVE-2022-22970, CVE-2022-22971.

If you need any further assistance on this please create a case, so that our technical support team can assist you.

Thanks

Naren

Re: Vulnerability CVE-2022-22970, CVE-2022-22971 - /replicate/endpoint_srv/externals/spring-core-5.1.9.RELEASE.jar

vijaynarayanan — Thu, 25 Aug 2022 03:12:51 GMT

Case# 00050175: Vulnerabilities CVE-2022-22970, CVE-2022-22971 is created for this issue.