IMPORTANT See the Notes section if prior to April 6, 3 PM PST you have updated TAS or Ops Manager or you have applied workarounds to TAS, Ops Manager or TKGi.

• VMware Tanzu Application Service for VMs (TAS)
  
• VMware Tanzu Operations Manager (Ops Manager)
  
• VMware Tanzu Kubernetes Grid Integrated Edition (TKGI)

A critical vulnerability in Spring Framework project identified by CVE-2022-22965 has been publicly disclosed which impacts VMware products.

Multiple products impacted by remote code execution vulnerability (CVE-2022-22965).

A malicious actor with network access to an impacted VMware product may exploit this issue to gain full control of the target system.

Fixes for CVE-2022-22965 are documented in the 'Fixed Version' column of the 'Response Matrix' below.

Workarounds for CVE-2022-22965 are documented in the 'Workarounds' column of the 'Response Matrix' below.

None.

• 2022-04-04: At the time of this publication, VMware has reviewed its product portfolio and found that the products listed in this advisory are affected. VMware continues to investigate this vulnerability, and will update the advisory should any changes evolve.
• 2022-04-06: VMware is aware of reports that exploitation of CVE-2022-22965 has occurred in the wild.
  2022-04-06: Customers that have applied the workaround for TAS, Ops Manager, or TKGI prior to April 6, 3 PM PST will need to reapply the workaround. The new workaround instructions now use UAA 74.5.37 which properly addresses CVE-2022-22965.
• 2022-04-06: Customers that have updated to TAS 2.10.29, 2.11.17, 2.12.10 or 2.13.1 will need to update to the TAS versions listed in this advisory. The patched versions now listed in this advisory ship with UAA 74.5.37 which properly addresses CVE-2022-22965.
• 2022-04-06: Customers that have updated to Ops Manager 2.8.20, 2.9.35 or 2.10.35 are advised to deploy the workaround as no version for Ops Manager is yet available that addresses CVE-2022-22965.
• 2022-04-07: Customers that have updated to Ops Manager 2.8.20, 2.9.35 or 2.10.35 will need to update to the Ops Manager versions listed in this advisory. The patched versions now listed in this advisory ship with UAA 74.5.37 which properly addresses CVE-2022-22965.
• 2022-04-08: Investigations have concluded, and the list of affected VMware products contained in the 'Response Matrix' below is complete.

None.

Fixed Version(s) and Release Notes:

Tanzu Application Service
Downloads and Documentation:
https://network.pivotal.io/products/elastic-runtime/

Tanzu Operations Manager
Downloads and Documentation:
https://network.tanzu.vmware.com/products/ops-manager

VMware TKGI
Downloads and Documentation:
https://network.pivotal.io/products/pivotal-container-service/

TKGI 1.12.5: https://docs.pivotal.io/tkgi/1-12/release-notes.html#1-12-5

TKGI 1.11.10: https://docs.pivotal.io/tkgi/1-11/release-notes.html#1-11-10

Mitre CVE Dictionary Links:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965

FIRST CVSSv3 Calculator:
CVE-2022-22965: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

2022-04-02 VMSA-2022-0010
Initial security advisory.

2022-04-06 VMSA-2022-0010.1

Updated workaround for Tanzu Operations Manager

2022-04-06 VMSA-2022-0010.2
Added new, patched versions for TAS. Added alert to the Notes section on the need to update versions or reapply the workaround.

2022-04-07 VMSA-2022-0010.3

Added new patched versions of Tanzu Operations Manager.

2022-04-08 VMSA-2022-0010.4

Added note confirming investigations have concluded.

2022-04-14 VMSA-2022-0010.5
Added patched versions for TKGI 1.12 and TKGI 1.11

2022-04-30 VMSA-2022-0010.6
Added patched versions for TKGI 1.13 and new patched version for TKGI 1.12

E-mail list for product security notifications and announcements:

https://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce 

This Security Advisory is posted to the following lists:  

[email protected]  

[email protected]  

[email protected] 

E-mail: [email protected]

PGP key at:

https://kb.vmware.com/kb/1055 

VMware Security Advisories

https://www.vmware.com/security/advisories 

VMware Security Response Policy

https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases

https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  

https://blogs.vmware.com/security 

Twitter

https://twitter.com/VMwareSRC

Copyright 2022 VMware Inc. All rights reserved.