VMware Releases Critical Security Update

Security update for Tanzu Application Service for VMs, Tanzu Operations Manager, and TKGI

Threat ID:: CC-4070
Threat Severity:: Information only
Published:: 5 April 2022 2:26 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security update for Tanzu Application Service for VMs, Tanzu Operations Manager, and TKGI

Affected platforms

The following platforms are known to be affected:

Versions: 2.13, 2.12, 2.11, 2.10 (Application Service)

VMware Tanzu Application Service for VMs

Versions: 2.10, 2.9, 2.8

VMware Tanzu Operations Manager

Versions: 1.13, 1.12, 1.1

VMware Tanzu Kubernetes Grid Integrated (TKGI)

Threat details

Introduction

VMware has released a security update to address the critical Spring Framework remote code execution (RCE) vulnerability known as CVE-2022-22965, which affects Tanzu Applications Service for VMs, Tanzu Operations Manager, and TKGI. A remote attacker could exploit this vulnerability to take control of an affected system.

Remediation advice

Affected organisations are encouraged to review VMware Security Advisory VMSA-2022-0010 and apply the necessary update.

Definitive source of threat updates

https://www.vmware.com/security/advisories/VMSA-2022-0010.html

CVE Vulnerabilities

Status Published

CVE-2022-22965

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Last edited: 5 April 2022 3:00 pm