Support Content Notification - Support Portal

Broadcom Agile Operations Software Security Advisory for Apache Commons Text CVE-2022-42889 Vulnerability

Product/Component

CA Agile Requirements Designer

9 more products

Notification Id

20988

Last Updated

28 October 2022

Initial Publication Date

21 October 2022

Status

OPEN

Severity

CRITICAL

CVSS Base Score

9.8

WorkAround

Affected CVE

Broadcom Agile Operations Software Security Advisory for Apache Commons Text CVE-2022-42889 Vulnerability

Issued: October 21, 2022

Updated: October 28 2130 UTC, 2022

Broadcom Agile Operations Software is investigating an Apache Commons Text remote code execution vulnerability that was disclosed by the Apache Commons Text team on 2022-10-13. CVE identifier CVE-2022-42889 has been assigned to this vulnerability, and it has a Critical risk rating. The Apache Commons Text team addressed this vulnerability in version 1.10.0. Apache Commons Text versions 1.5 through 1.9 are affected. In addition to checking this advisory for updates, and checking individual product support pages for updates, you may open a support case.

Risk Rating

CVE: CVE-2022-42889 - Critical
Base CVSS 3.1 Score: 9.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Products Under Investigation

App Synthetic Monitor (ASM) - https://knowledge.broadcom.com/external/article?articleId=252503
DX NetOps CABI - https://knowledge.broadcom.com/external/article?articleId=252335

Non-Affected Products that include Apache Commons Text

Non-Affected Products that do not include Apache Commons Text

References

Broadcom main landing page for CVE-2022-42889: https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/CriticalAlerts/0/20991
CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42889
NVD: https://nvd.nist.gov/vuln/detail/CVE-2022-42889
Apache Commons Text: https://commons.apache.org/proper/commons-text/security.html
GHSL-2022-018: Arbitrary Code Execution in Apache Commons Text - CVE-2022-42889 (Security Researcher Advisory) - https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/

Change History

Version 1.0: 2022-10-21 - Initial Release
Version 1.1: 2022-10-25 0615 UTC - Added all products with available status
Version 1.2: 2022-10-25 1545 UTC - Moved AppNeta from Affected to Not Affected
Version 1.3: 2022-10-27 0100 UTC - Moved DOI to Affected; moved SCM from Non-Affected w/o ACT to Non-Affected w/ ACT; changed AppNeta KB url.
Version 1.4: 2022-10-27 1930 UTC - Moved SM-APM from Affected to Non-Affected.
Version 1.5: 2022-10-28 2130 UTC - Added Application Delivery Analysis KB url.

Broadcom Software customers may receive product alerts and advisories by subscribing to Proactive Notifications.

Customers who require additional information about this notice may contact Broadcom Software Support at https://support.broadcom.com/.

Copyright © 2022 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. Broadcom, the pulse logo, Connecting everything, CA Technologies and the CA technologies logo are among the trademarks of Broadcom. All trademarks, trade names, service marks and logos referenced herein belong to their respective companies.