{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat Process Automation Manager.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Process Automation Manager is an open source business process management suite that combines process management and decision service management and enables business and IT users to create, manage, validate, and deploy process applications and decision services.\n\nThis asynchronous security patch is an update to Red Hat Process Automation Manager 7.\n\nSecurity Fix(es):\n\n* spring-webmvc: spring-framework: RCE via Data Binding on JDK 9+ (CVE-2022-22965)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:1378",
        "url": "https://access.redhat.com/errata/RHSA-2022:1378"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2022-003",
        "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2022-003"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=rhpam\u0026downloadType=securityPatches\u0026version=7.12.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=rhpam\u0026downloadType=securityPatches\u0026version=7.12.1"
      },
      {
        "category": "external",
        "summary": "2070348",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2070348"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1378.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Process Automation Manager 7.12.1 security update",
    "tracking": {
      "current_release_date": "2026-03-18T02:16:37+00:00",
      "generator": {
        "date": "2026-03-18T02:16:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.3"
        }
      },
      "id": "RHSA-2022:1378",
      "initial_release_date": "2022-04-14T17:09:11+00:00",
      "revision_history": [
        {
          "date": "2022-04-14T17:09:11+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-04-14T17:09:11+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-18T02:16:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHPAM 7.12.1 async",
                "product": {
                  "name": "RHPAM 7.12.1 async",
                  "product_id": "RHPAM 7.12.1 async",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7.12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Process Automation Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-22965",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2022-03-31T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2070348"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, (transitively affected from Spring Beans), using parameter data binding. This flaw allows an attacker to pass specially-constructed malicious requests to certain parameters and possibly gain access to normally-restricted functionality within the Java Virtual Machine.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "spring-framework: RCE via Data Binding on JDK 9+",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The reporter of this flaw provided a proof-of-concept that relied on Apache Tomcat; it accessed the classloader and changed logging properties to place a web shell in Tomcat\u0027s root directory, and was able to call various commands subsequently.\n\nThere are several conditions required to achieve this exploit:\n-Java 9 or newer version\n-Apache Tomcat as the Servlet container\n-packaged as WAR file\n-spring-webmvc or spring-webflux dependency\n-no protections in place against malicious data bindings (ex: WebDataBinder allow list)\n\nThere may be other exploit paths than this, possibly not utilizing Tomcat.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHPAM 7.12.1 async"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-22965"
        },
        {
          "category": "external",
          "summary": "RHBZ#2070348",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2070348"
        },
        {
          "category": "external",
          "summary": "RHSB-2022-003",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2022-003"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-22965",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-22965"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965"
        },
        {
          "category": "external",
          "summary": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement",
          "url": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement"
        },
        {
          "category": "external",
          "summary": "https://tanzu.vmware.com/security/cve-2022-22965",
          "url": "https://tanzu.vmware.com/security/cve-2022-22965"
        },
        {
          "category": "external",
          "summary": "https://www.cyberkendra.com/2022/03/spring4shell-details-and-exploit-code.html",
          "url": "https://www.cyberkendra.com/2022/03/spring4shell-details-and-exploit-code.html"
        },
        {
          "category": "external",
          "summary": "https://www.praetorian.com/blog/spring-core-jdk9-rce/",
          "url": "https://www.praetorian.com/blog/spring-core-jdk9-rce/"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2022-03-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-14T17:09:11+00:00",
          "details": "A Spring MVC or Spring WebFlux application running on JDK 9 and above may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment.\n\nThis release upgrades Spring to 5.3.18 and Spring Boot to 2.6.6 which fixes the Spring MVC and WebFlux jars.\n\nFor on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHPAM 7.12.1 async"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1378"
        },
        {
          "category": "workaround",
          "details": "For those who are not able to upgrade affected Spring classes to the fixed versions, there is a workaround customers can implement for their applications, via setting disallowed fields on the data binder, and denying various iterations of the string \"class.*\" \n\nFor full implementation details, see Spring\u0027s early announcement post in the \"suggested workarounds\" section: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds",
          "product_ids": [
            "RHPAM 7.12.1 async"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHPAM 7.12.1 async"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-04-04T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "spring-framework: RCE via Data Binding on JDK 9+"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat Decision Manager.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Decision Manager is an open source decision management platform that combines business rules management, complex event processing, Decision Model \u0026 Notation (DMN) execution, and business optimization for solving planning problems. It automates business decisions and makes that logic available to the entire business. \n\nThis asynchronous security patch is an update to Red Hat Decision Manager 7.\n\nSecurity Fix(es):\n\n* spring-webmvc: spring-framework: RCE via Data Binding on JDK 9+ (CVE-2022-22965)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:1379",
        "url": "https://access.redhat.com/errata/RHSA-2022:1379"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2022-003",
        "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2022-003"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=rhdm\u0026version=7.12.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=rhdm\u0026version=7.12.1"
      },
      {
        "category": "external",
        "summary": "2070348",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2070348"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1379.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Decision Manager 7.12.1 security update",
    "tracking": {
      "current_release_date": "2026-03-18T02:16:37+00:00",
      "generator": {
        "date": "2026-03-18T02:16:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.3"
        }
      },
      "id": "RHSA-2022:1379",
      "initial_release_date": "2022-04-14T17:33:07+00:00",
      "revision_history": [
        {
          "date": "2022-04-14T17:33:07+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-04-14T17:33:07+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-18T02:16:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHDM 7.12.1 async",
                "product": {
                  "name": "RHDM 7.12.1 async",
                  "product_id": "RHDM 7.12.1 async",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:7.12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Decision Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-22965",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2022-03-31T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2070348"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, (transitively affected from Spring Beans), using parameter data binding. This flaw allows an attacker to pass specially-constructed malicious requests to certain parameters and possibly gain access to normally-restricted functionality within the Java Virtual Machine.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "spring-framework: RCE via Data Binding on JDK 9+",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The reporter of this flaw provided a proof-of-concept that relied on Apache Tomcat; it accessed the classloader and changed logging properties to place a web shell in Tomcat\u0027s root directory, and was able to call various commands subsequently.\n\nThere are several conditions required to achieve this exploit:\n-Java 9 or newer version\n-Apache Tomcat as the Servlet container\n-packaged as WAR file\n-spring-webmvc or spring-webflux dependency\n-no protections in place against malicious data bindings (ex: WebDataBinder allow list)\n\nThere may be other exploit paths than this, possibly not utilizing Tomcat.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHDM 7.12.1 async"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-22965"
        },
        {
          "category": "external",
          "summary": "RHBZ#2070348",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2070348"
        },
        {
          "category": "external",
          "summary": "RHSB-2022-003",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2022-003"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-22965",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-22965"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965"
        },
        {
          "category": "external",
          "summary": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement",
          "url": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement"
        },
        {
          "category": "external",
          "summary": "https://tanzu.vmware.com/security/cve-2022-22965",
          "url": "https://tanzu.vmware.com/security/cve-2022-22965"
        },
        {
          "category": "external",
          "summary": "https://www.cyberkendra.com/2022/03/spring4shell-details-and-exploit-code.html",
          "url": "https://www.cyberkendra.com/2022/03/spring4shell-details-and-exploit-code.html"
        },
        {
          "category": "external",
          "summary": "https://www.praetorian.com/blog/spring-core-jdk9-rce/",
          "url": "https://www.praetorian.com/blog/spring-core-jdk9-rce/"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2022-03-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-14T17:33:07+00:00",
          "details": "A Spring MVC or Spring WebFlux application running on JDK 9 and above might be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment.\n\nThis release upgrades Spring to 5.3.18 and Spring Boot to 2.6.6 which fixes the Spring MVC and WebFlux jars.\n\nFor on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "RHDM 7.12.1 async"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1379"
        },
        {
          "category": "workaround",
          "details": "For those who are not able to upgrade affected Spring classes to the fixed versions, there is a workaround customers can implement for their applications, via setting disallowed fields on the data binder, and denying various iterations of the string \"class.*\" \n\nFor full implementation details, see Spring\u0027s early announcement post in the \"suggested workarounds\" section: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds",
          "product_ids": [
            "RHDM 7.12.1 async"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHDM 7.12.1 async"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-04-04T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "spring-framework: RCE via Data Binding on JDK 9+"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AMQ Broker 7.8.6 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. \n\nThis release of Red Hat AMQ Broker 7.8.6 serves as a replacement for Red Hat AMQ Broker 7.8.5, and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* spring-webmvc: spring-framework: RCE via Data Binding on JDK 9+ (CVE-2022-22965)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:1626",
        "url": "https://access.redhat.com/errata/RHSA-2022:1626"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2022-003",
        "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2022-003"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.broker\u0026version=7.8.6",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.broker\u0026version=7.8.6"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_amq/",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_amq/"
      },
      {
        "category": "external",
        "summary": "2070348",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2070348"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1626.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AMQ Broker 7.8.6 release and security update",
    "tracking": {
      "current_release_date": "2026-03-18T02:16:41+00:00",
      "generator": {
        "date": "2026-03-18T02:16:41+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.3"
        }
      },
      "id": "RHSA-2022:1626",
      "initial_release_date": "2022-04-27T09:46:46+00:00",
      "revision_history": [
        {
          "date": "2022-04-27T09:46:46+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-04-27T09:46:46+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-18T02:16:41+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AMQ 7.8.6",
                "product": {
                  "name": "Red Hat AMQ 7.8.6",
                  "product_id": "Red Hat AMQ 7.8.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:amq_broker:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss AMQ"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-22965",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2022-03-31T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2070348"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, (transitively affected from Spring Beans), using parameter data binding. This flaw allows an attacker to pass specially-constructed malicious requests to certain parameters and possibly gain access to normally-restricted functionality within the Java Virtual Machine.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "spring-framework: RCE via Data Binding on JDK 9+",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The reporter of this flaw provided a proof-of-concept that relied on Apache Tomcat; it accessed the classloader and changed logging properties to place a web shell in Tomcat\u0027s root directory, and was able to call various commands subsequently.\n\nThere are several conditions required to achieve this exploit:\n-Java 9 or newer version\n-Apache Tomcat as the Servlet container\n-packaged as WAR file\n-spring-webmvc or spring-webflux dependency\n-no protections in place against malicious data bindings (ex: WebDataBinder allow list)\n\nThere may be other exploit paths than this, possibly not utilizing Tomcat.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ 7.8.6"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-22965"
        },
        {
          "category": "external",
          "summary": "RHBZ#2070348",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2070348"
        },
        {
          "category": "external",
          "summary": "RHSB-2022-003",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2022-003"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-22965",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-22965"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965"
        },
        {
          "category": "external",
          "summary": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement",
          "url": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement"
        },
        {
          "category": "external",
          "summary": "https://tanzu.vmware.com/security/cve-2022-22965",
          "url": "https://tanzu.vmware.com/security/cve-2022-22965"
        },
        {
          "category": "external",
          "summary": "https://www.cyberkendra.com/2022/03/spring4shell-details-and-exploit-code.html",
          "url": "https://www.cyberkendra.com/2022/03/spring4shell-details-and-exploit-code.html"
        },
        {
          "category": "external",
          "summary": "https://www.praetorian.com/blog/spring-core-jdk9-rce/",
          "url": "https://www.praetorian.com/blog/spring-core-jdk9-rce/"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2022-03-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-27T09:46:46+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ 7.8.6"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1626"
        },
        {
          "category": "workaround",
          "details": "For those who are not able to upgrade affected Spring classes to the fixed versions, there is a workaround customers can implement for their applications, via setting disallowed fields on the data binder, and denying various iterations of the string \"class.*\" \n\nFor full implementation details, see Spring\u0027s early announcement post in the \"suggested workarounds\" section: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds",
          "product_ids": [
            "Red Hat AMQ 7.8.6"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ 7.8.6"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-04-04T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "spring-framework: RCE via Data Binding on JDK 9+"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AMQ Broker 7.9.4 is now available from the Red Hat Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "AMQ Broker is a high-performance messaging implementation based on ActiveMQ Artemis. It uses an asynchronous journal for fast message persistence, and supports multiple languages, protocols, and platforms. \n\nThis release of Red Hat AMQ Broker 7.9.4 serves as a replacement for Red Hat AMQ Broker 7.9.3, and includes security and bug fixes, and enhancements. For further information, refer to the release notes linked to in the References section.\n\nSecurity Fix(es):\n\n* spring-webmvc: spring-framework: RCE via Data Binding on JDK 9+ (CVE-2022-22965)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:1627",
        "url": "https://access.redhat.com/errata/RHSA-2022:1627"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/vulnerabilities/RHSB-2022-003",
        "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2022-003"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.broker\u0026version=7.9.4",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=jboss.amq.broker\u0026version=7.9.4"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_amq/",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_amq/"
      },
      {
        "category": "external",
        "summary": "2070348",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2070348"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1627.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AMQ Broker 7.9.4 release and security update",
    "tracking": {
      "current_release_date": "2026-03-18T02:16:42+00:00",
      "generator": {
        "date": "2026-03-18T02:16:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.3"
        }
      },
      "id": "RHSA-2022:1627",
      "initial_release_date": "2022-04-27T09:46:55+00:00",
      "revision_history": [
        {
          "date": "2022-04-27T09:46:55+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-04-27T09:46:55+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-18T02:16:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AMQ 7.9.4",
                "product": {
                  "name": "Red Hat AMQ 7.9.4",
                  "product_id": "Red Hat AMQ 7.9.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:amq_broker:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss AMQ"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-22965",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2022-03-31T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2070348"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Spring Framework, specifically within two modules called Spring MVC and Spring WebFlux, (transitively affected from Spring Beans), using parameter data binding. This flaw allows an attacker to pass specially-constructed malicious requests to certain parameters and possibly gain access to normally-restricted functionality within the Java Virtual Machine.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "spring-framework: RCE via Data Binding on JDK 9+",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The reporter of this flaw provided a proof-of-concept that relied on Apache Tomcat; it accessed the classloader and changed logging properties to place a web shell in Tomcat\u0027s root directory, and was able to call various commands subsequently.\n\nThere are several conditions required to achieve this exploit:\n-Java 9 or newer version\n-Apache Tomcat as the Servlet container\n-packaged as WAR file\n-spring-webmvc or spring-webflux dependency\n-no protections in place against malicious data bindings (ex: WebDataBinder allow list)\n\nThere may be other exploit paths than this, possibly not utilizing Tomcat.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AMQ 7.9.4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-22965"
        },
        {
          "category": "external",
          "summary": "RHBZ#2070348",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2070348"
        },
        {
          "category": "external",
          "summary": "RHSB-2022-003",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2022-003"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-22965",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-22965"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965"
        },
        {
          "category": "external",
          "summary": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement",
          "url": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement"
        },
        {
          "category": "external",
          "summary": "https://tanzu.vmware.com/security/cve-2022-22965",
          "url": "https://tanzu.vmware.com/security/cve-2022-22965"
        },
        {
          "category": "external",
          "summary": "https://www.cyberkendra.com/2022/03/spring4shell-details-and-exploit-code.html",
          "url": "https://www.cyberkendra.com/2022/03/spring4shell-details-and-exploit-code.html"
        },
        {
          "category": "external",
          "summary": "https://www.praetorian.com/blog/spring-core-jdk9-rce/",
          "url": "https://www.praetorian.com/blog/spring-core-jdk9-rce/"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2022-03-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-04-27T09:46:55+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).",
          "product_ids": [
            "Red Hat AMQ 7.9.4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1627"
        },
        {
          "category": "workaround",
          "details": "For those who are not able to upgrade affected Spring classes to the fixed versions, there is a workaround customers can implement for their applications, via setting disallowed fields on the data binder, and denying various iterations of the string \"class.*\" \n\nFor full implementation details, see Spring\u0027s early announcement post in the \"suggested workarounds\" section: https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds",
          "product_ids": [
            "Red Hat AMQ 7.9.4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AMQ 7.9.4"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2022-04-04T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "spring-framework: RCE via Data Binding on JDK 9+"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "notes": [
      {
        "category": "summary",
        "text": "A vulnerability in Spring Framework was disclosed, that could allow remote unauthenticated attackers to execute code on vulnerable systems. The vulnerability is tracked as CVE-2022-22965 and is also known as \"Spring4Shell\" or \"SpringShell\".\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: \nhttps://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-254054: Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-254054: Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-254054.txt"
      },
      {
        "category": "self",
        "summary": "SSA-254054: Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-254054.json"
      }
    ],
    "title": "SSA-254054: Spring Framework Vulnerability (Spring4Shell or SpringShell, CVE-2022-22965) - Impact to Siemens Products",
    "tracking": {
      "current_release_date": "2022-10-11T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-254054",
      "initial_release_date": "2022-04-19T00:00:00Z",
      "revision_history": [
        {
          "date": "2022-04-19T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2022-04-27T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added solution for Siveillance Identity"
        },
        {
          "date": "2022-06-14T00:00:00Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Added affected products SIMATIC Speech Assistant for Machines (SAM) and SINEC NMS"
        },
        {
          "date": "2022-10-11T00:00:00Z",
          "legacy_version": "1.3",
          "number": "4",
          "summary": "Added fix for SINEC NMS"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 2.0.4",
                "product": {
                  "name": "Operation Scheduler",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "Operation Scheduler"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V1.2.1",
                "product": {
                  "name": "SIMATIC Speech Assistant for Machines (SAM)",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "SIMATIC Speech Assistant for Machines (SAM)"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c V1.0.3",
                "product": {
                  "name": "SINEC NMS",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "SINEC NMS"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SiPass integrated V2.80",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "SiPass integrated V2.80"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "SiPass integrated V2.85",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "SiPass integrated V2.85"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Siveillance Identity V1.5",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "Siveillance Identity V1.5"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Siveillance Identity V1.6",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "Siveillance Identity V1.6"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-22965",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Block both incoming and outgoing connections between the system and the Internet",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Apply the patch",
          "product_ids": [
            "4",
            "5"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109805711/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V2.0.4 or later version",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.5 SP4 and apply the patch",
          "product_ids": [
            "6"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109810454/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.6 SP1 and apply the patch",
          "product_ids": [
            "7"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109810454/"
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.2.1 or later version. Please contact customer support to obtain the patch",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.0.3 or later version",
          "product_ids": [
            "3"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109813788/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7"
          ]
        }
      ],
      "title": "CVE-2022-22965"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202203-1506",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "sinec network management system",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "1.0.3"
      },
      {
        "model": "communications cloud native core unified data repository",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.15.0"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "21.0.0"
      },
      {
        "model": "communications cloud native core network function cloud native environment",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "22.1.0"
      },
      {
        "model": "spring framework",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.3.0"
      },
      {
        "model": "financial services behavior detection platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.1.0"
      },
      {
        "model": "netbackup virtual appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "4.0"
      },
      {
        "model": "retail bulk data integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3"
      },
      {
        "model": "communications cloud native core policy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "22.1.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.4.0"
      },
      {
        "model": "commerce platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "11.3.2"
      },
      {
        "model": "communications cloud native core network slice selection function",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.8.0"
      },
      {
        "model": "netbackup appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "4.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3"
      },
      {
        "model": "cx cloud agent",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "cisco",
        "version": "2.1.0"
      },
      {
        "model": "operation scheduler",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.0.4"
      },
      {
        "model": "communications cloud native core network function cloud native environment",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.10.0"
      },
      {
        "model": "communications cloud native core console",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "22.1.0"
      },
      {
        "model": "financial services analytical applications infrastructure",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.1"
      },
      {
        "model": "flex appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "2.0"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.3.2"
      },
      {
        "model": "retail xstore point of service",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "20.0.1"
      },
      {
        "model": "siveillance identity",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "1.6"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.0.1"
      },
      {
        "model": "retail merchandising system",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3"
      },
      {
        "model": "access appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "7.4.3.200"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "16.0.3"
      },
      {
        "model": "financial services enterprise case management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.2.0"
      },
      {
        "model": "sipass integrated",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.80"
      },
      {
        "model": "sipass integrated",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.85"
      },
      {
        "model": "netbackup appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "4.0.0.1"
      },
      {
        "model": "netbackup virtual appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "4.1"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.3.2"
      },
      {
        "model": "access appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "7.4.3"
      },
      {
        "model": "netbackup appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "4.0"
      },
      {
        "model": "netbackup flex scale appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "3.0"
      },
      {
        "model": "siveillance identity",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "1.5"
      },
      {
        "model": "communications cloud native core network repository function",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.15.0"
      },
      {
        "model": "access appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "7.4.3.100"
      },
      {
        "model": "communications cloud native core network slice selection function",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.15.0"
      },
      {
        "model": "communications policy management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.6.0.0.0"
      },
      {
        "model": "flex appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "2.0.2"
      },
      {
        "model": "financial services enterprise case management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.1.1"
      },
      {
        "model": "retail customer management and segmentation foundation",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.0"
      },
      {
        "model": "simatic speech assistant for machines",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "1.2.1"
      },
      {
        "model": "financial services enterprise case management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.1.0"
      },
      {
        "model": "communications cloud native core unified data repository",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "22.1.0"
      },
      {
        "model": "financial services behavior detection platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.1.1"
      },
      {
        "model": "communications cloud native core security edge protection proxy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.7.0"
      },
      {
        "model": "netbackup virtual appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "4.1.0.1"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "14.1.1.0.0"
      },
      {
        "model": "sd-wan edge",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.0"
      },
      {
        "model": "netbackup virtual appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "4.0.0.1"
      },
      {
        "model": "communications cloud native core policy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.15.0"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.2.20"
      },
      {
        "model": "mysql enterprise monitor",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.0.29"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.4.1"
      },
      {
        "model": "financial services analytical applications infrastructure",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.2.0"
      },
      {
        "model": "communications cloud native core automated test suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "22.1.0"
      },
      {
        "model": "weblogic server",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "12.2.1.3.0"
      },
      {
        "model": "netbackup flex scale appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "2.1"
      },
      {
        "model": "flex appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "1.3"
      },
      {
        "model": "communications cloud native core security edge protection proxy",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "22.1.0"
      },
      {
        "model": "spring framework",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "vmware",
        "version": "5.3.18"
      },
      {
        "model": "communications cloud native core network exposure function",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "22.1.0"
      },
      {
        "model": "sd-wan edge",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "9.1"
      },
      {
        "model": "retail integration bus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.3.1"
      },
      {
        "model": "flex appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "2.1"
      },
      {
        "model": "communications cloud native core binding support function",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "22.1.3"
      },
      {
        "model": "flex appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "2.0.1"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.5.0"
      },
      {
        "model": "financial services behavior detection platform",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "8.1.2.0"
      },
      {
        "model": "netbackup appliance",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "veritas",
        "version": "4.1.0.1"
      },
      {
        "model": "communications cloud native core console",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.9.0"
      },
      {
        "model": "communications cloud native core automated test suite",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "1.9.0"
      },
      {
        "model": "retail customer management and segmentation foundation",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "18.0"
      },
      {
        "model": "communications unified inventory management",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "7.4.2"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "15.0.3.1"
      },
      {
        "model": "retail customer management and segmentation foundation",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "17.0"
      },
      {
        "model": "retail merchandising system",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.0.1"
      },
      {
        "model": "retail financial integration",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "19.0.1"
      },
      {
        "model": "communications cloud native core network repository function",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "22.1.0"
      },
      {
        "model": "communications cloud native core network slice selection function",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "22.1.0"
      },
      {
        "model": "product lifecycle analytics",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "oracle",
        "version": "3.6.1"
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-22965"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "This document was written by Will DormannWe have not received a statement from the vendor.",
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#970766"
      }
    ],
    "trust": 0.8
  },
  "cve": "CVE-2022-22965",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2022-22965",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.1,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-411825",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2022-22965",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2022-22965",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "id": "CVE-2022-22965",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202203-2642",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202203-2514",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-411825",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2022-22965",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-411825"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-22965"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2642"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2514"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-22965"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-22965"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. The Spring Framework insecurely handles PropertyDescriptor objects, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system.CVE-2022-22965 AffectedCVE-2022-22965 Affected. Description:\n\nAMQ Broker is a high-performance messaging implementation based on ActiveMQ\nArtemis. It uses an asynchronous journal for fast message persistence, and\nsupports multiple languages, protocols, and platforms. For further information, refer to the release notes linked to\nin the References section. The purpose of this text-only errata is to inform you\nabout the security issues fixed in this release. Description:\n\nA micro version update (from 1.6.4 to 1.6.5) is now available for Red Hat\nCamel K that includes CVE fixes in the base images, which are documented in\nthe Release Notes document linked in the References section. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n4. \n\nInstallation instructions are available from the Fuse 7.10 product\ndocumentation page:\nhttps://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/\n\n4. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Low: Red Hat Decision Manager 7.12.1 security update\nAdvisory ID:       RHSA-2022:1379-01\nProduct:           Red Hat Decision Manager\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2022:1379\nIssue date:        2022-04-14\nCVE Names:         CVE-2022-22965\n====================================================================\n1. Summary:\n\nAn update is now available for Red Hat Decision Manager. \n\nRed Hat Product Security has rated this update as having a security impact\nof Low. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section. \n\n2. Description:\n\nRed Hat Decision Manager is an open source decision management platform\nthat combines business rules management, complex event processing, Decision\nModel \u0026 Notation (DMN) execution, and business optimization for solving\nplanning problems. It automates business decisions and makes that logic\navailable to the entire business. \n\nThis asynchronous security patch is an update to Red Hat Decision Manager\n7. \n\nSecurity Fix(es):\n\n* spring-webmvc: spring-framework: RCE via Data Binding on JDK 9+\n(CVE-2022-22965)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n3. \n\nThis release upgrades Spring to 5.3.18 and Spring Boot to 2.6.6 which fixes\nthe Spring MVC and WebFlux jars. \n\nFor on-premise installations, before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on. \n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update; after installing the update,\nrestart the server by starting the JBoss Application Server process. \n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). \n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n2070348 - CVE-2022-22965 spring-framework: RCE via Data Binding on JDK 9+\n\n5. References:\n\nhttps://access.redhat.com/security/cve/CVE-2022-22965\nhttps://access.redhat.com/security/updates/classification/#low\nhttps://access.redhat.com/security/vulnerabilities/RHSB-2022-003\nhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=rhdm\u0026version=7.12.1\n\n6. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2022 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBYlidHNzjgjWX9erEAQhBihAApV3yXc8aEuRq9fMKL4EnxKcmHt9dgnX2\n/Xsdp+isSEvWlE+TC/Ou0tptT1ZPfO3Adm/bXbsboaiq790W+aF8qHEYuA+WxtRW\nRY9cx4AS/QfRo+puk36QAWUSEx4WzKeU1no/5A7hezcPxIEGP+EdSX4DgDaVW9mB\nCZndXwiYAzLyYgVFI/y5AJP8CPZTvwFjdunOBDwqqNsKiVgFOjqHMJo/X+yus4bU\naFF0BAsA0OVCrjdnWV0fUqF1iON8cbELW7JqkGobM22PZZ6ngxzTXUTbvD1QovLM\nCbj2Ay7l7DHH/3v9Hqk7NLpzp/fa9Z/lQ5c+3okHu0QvanphRllsC893/KGGMXfa\n7+S3iWFKV2cJ2249z01eZgX30s7rlSlFRTB9hUlitWLiYaMkWWW0iqt0+2cPkjDv\nzP0hy1pYCyCFLluS85FVqW/9HBItNwReuXp9Vv3JqDy8L5+DIVv4WmSYcr4LCcj2\nEC5WsIjNW7G4dL0RCukt+HascGTD+huNbzsrDuln4vQJ2HG+4vmH7Cmmlr4MvpHD\nBw4BW6UI8a09axvbUVi2x+w1qTTdiO9J1x4ngaFKjbvItNpT3VRB3YfLcPck1Zv6\nDCEC2g11LdPnO2JR5M6t2eMsFlkfLDtqDFotVVzGLBXQWj7I5R2YK+OPrEF2dnXD\nPjhf0e6lKl4=xaz4\n-----END PGP SIGNATURE-----\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://listman.redhat.com/mailman/listinfo/rhsa-announce\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-22965"
      },
      {
        "db": "CERT/CC",
        "id": "VU#970766"
      },
      {
        "db": "VULHUB",
        "id": "VHN-411825"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-22965"
      },
      {
        "db": "PACKETSTORM",
        "id": "166874"
      },
      {
        "db": "PACKETSTORM",
        "id": "166872"
      },
      {
        "db": "PACKETSTORM",
        "id": "166691"
      },
      {
        "db": "PACKETSTORM",
        "id": "166706"
      },
      {
        "db": "PACKETSTORM",
        "id": "166715"
      },
      {
        "db": "PACKETSTORM",
        "id": "166731"
      },
      {
        "db": "PACKETSTORM",
        "id": "166732"
      }
    ],
    "trust": 2.43
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-411825",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-411825"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-22965",
        "trust": 3.9
      },
      {
        "db": "CERT/CC",
        "id": "VU#970766",
        "trust": 1.8
      },
      {
        "db": "PACKETSTORM",
        "id": "166713",
        "trust": 1.7
      },
      {
        "db": "PACKETSTORM",
        "id": "167011",
        "trust": 1.7
      },
      {
        "db": "SIEMENS",
        "id": "SSA-254054",
        "trust": 1.7
      },
      {
        "db": "CS-HELP",
        "id": "SB2022040109",
        "trust": 1.2
      },
      {
        "db": "CS-HELP",
        "id": "SB2022033109",
        "trust": 1.2
      },
      {
        "db": "PACKETSTORM",
        "id": "166874",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "166691",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "166732",
        "trust": 0.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2642",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022060811",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022070602",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022060716",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022042734",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022042546",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022060304",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022072038",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022071213",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022052302",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022042277",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022072087",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022041951",
        "trust": 0.6
      },
      {
        "db": "CS-HELP",
        "id": "SB2022042126",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.3155",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.5097",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.1844",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.1636",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.1593",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.1444.8",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.1674",
        "trust": 0.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-286-05",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2514",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-411825",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-22965",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "166872",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "166706",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "166715",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "166731",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#970766"
      },
      {
        "db": "VULHUB",
        "id": "VHN-411825"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-22965"
      },
      {
        "db": "PACKETSTORM",
        "id": "166874"
      },
      {
        "db": "PACKETSTORM",
        "id": "166872"
      },
      {
        "db": "PACKETSTORM",
        "id": "166691"
      },
      {
        "db": "PACKETSTORM",
        "id": "166706"
      },
      {
        "db": "PACKETSTORM",
        "id": "166715"
      },
      {
        "db": "PACKETSTORM",
        "id": "166731"
      },
      {
        "db": "PACKETSTORM",
        "id": "166732"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2642"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2514"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-22965"
      }
    ]
  },
  "id": "VAR-202203-1506",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-411825"
      }
    ],
    "trust": 0.70416665
  },
  "last_update_date": "2025-11-21T21:36:38.238000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Spring Framework Fixes for code injection vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=187595"
      },
      {
        "title": "Red Hat: Low: Red Hat Process Automation Manager 7.12.1 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221378 - Security Advisory"
      },
      {
        "title": "Red Hat: Low: Red Hat Decision Manager 7.12.1 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221379 - Security Advisory"
      },
      {
        "title": "Red Hat: Low: Red Hat AMQ Broker 7.9.4 release and security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221627 - Security Advisory"
      },
      {
        "title": "Red Hat: Low: Red Hat Fuse 7.10.2 release and security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221360 - Security Advisory"
      },
      {
        "title": "Red Hat: Low: Red Hat Integration Camel-K 1.6.5 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221333 - Security Advisory"
      },
      {
        "title": "Red Hat: Low: Red Hat Integration Camel Extensions for Quarkus 2.2.1-1 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221306 - Security Advisory"
      },
      {
        "title": "Red Hat: Low: Red Hat AMQ Broker 7.8.6 release and security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20221626 - Security Advisory"
      },
      {
        "title": "IBM: Security Bulletin: IBM Cloud Pak for Business Automation is affected but not classified as vulnerable by a remote code execution in Spring Framework [CVE-2022-22965]",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=e6cbc0e97f1832a63f66e10869253ecf"
      },
      {
        "title": "Cisco: Vulnerability in Spring Framework Affecting Cisco Products: March 2022",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-java-spring-rce-Zx9GUc67"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/coffeehb/Spring4Shell "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2022-22965"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2642"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-94",
        "trust": 1.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-411825"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-22965"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.5,
        "url": "https://tanzu.vmware.com/security/cve-2022-22965"
      },
      {
        "trust": 2.9,
        "url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-java-spring-rce-zx9guc67"
      },
      {
        "trust": 2.3,
        "url": "http://packetstormsecurity.com/files/166713/spring4shell-code-execution.html"
      },
      {
        "trust": 2.3,
        "url": "http://packetstormsecurity.com/files/167011/spring4shell-spring-framework-class-property-remote-code-execution.html"
      },
      {
        "trust": 2.3,
        "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
      },
      {
        "trust": 1.9,
        "url": "https://access.redhat.com/security/cve/cve-2022-22965"
      },
      {
        "trust": 1.7,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf"
      },
      {
        "trust": 1.7,
        "url": "https://psirt.global.sonicwall.com/vuln-detail/snwlid-2022-0005"
      },
      {
        "trust": 1.7,
        "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
      },
      {
        "trust": 1.2,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022040109"
      },
      {
        "trust": 1.2,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022033109"
      },
      {
        "trust": 1.0,
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=cve-2022-22965"
      },
      {
        "trust": 1.0,
        "url": "https://www.kb.cert.org/vuls/id/970766"
      },
      {
        "trust": 0.8,
        "url": "cve-2022-22965  "
      },
      {
        "trust": 0.7,
        "url": "https://listman.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/vulnerabilities/rhsb-2022-003"
      },
      {
        "trust": 0.7,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-22965"
      },
      {
        "trust": 0.7,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.7,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.1674"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022072038"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.1593"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022042126"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2022-22965/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/166874/red-hat-security-advisory-2022-1626-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022041951"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022042546"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022060304"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/166691/red-hat-security-advisory-2022-1306-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.1844"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/166732/red-hat-security-advisory-2022-1379-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022070602"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022071213"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022072087"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022060716"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022042277"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.1444.8"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022042734"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022060811"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.5097"
      },
      {
        "trust": 0.6,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-286-05"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.3155"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.1636"
      },
      {
        "trust": 0.6,
        "url": "https://www.cybersecurity-help.cz/vdb/sb2022052302"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_amq/"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q1"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=jboss.amq.broker\u0026version=7.8.6"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2022:1626"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2022:1627"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=jboss.amq.broker\u0026version=7.9.4"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2022:1306"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=red.hat.integration\u0026version=2022-q1"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2022:1333"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=red.hat.integration\u0026version"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions\u0026product=jboss.fuse\u0026version=7.10.2"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_fuse/7.10/"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2022:1360"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=rhpam\u0026downloadtype=securitypatches\u0026version=7.12.1"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2022:1378"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2022:1379"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=securitypatches\u0026product=rhdm\u0026version=7.12.1"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#970766"
      },
      {
        "db": "VULHUB",
        "id": "VHN-411825"
      },
      {
        "db": "PACKETSTORM",
        "id": "166874"
      },
      {
        "db": "PACKETSTORM",
        "id": "166872"
      },
      {
        "db": "PACKETSTORM",
        "id": "166691"
      },
      {
        "db": "PACKETSTORM",
        "id": "166706"
      },
      {
        "db": "PACKETSTORM",
        "id": "166715"
      },
      {
        "db": "PACKETSTORM",
        "id": "166731"
      },
      {
        "db": "PACKETSTORM",
        "id": "166732"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2642"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2514"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-22965"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#970766"
      },
      {
        "db": "VULHUB",
        "id": "VHN-411825"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-22965"
      },
      {
        "db": "PACKETSTORM",
        "id": "166874"
      },
      {
        "db": "PACKETSTORM",
        "id": "166872"
      },
      {
        "db": "PACKETSTORM",
        "id": "166691"
      },
      {
        "db": "PACKETSTORM",
        "id": "166706"
      },
      {
        "db": "PACKETSTORM",
        "id": "166715"
      },
      {
        "db": "PACKETSTORM",
        "id": "166731"
      },
      {
        "db": "PACKETSTORM",
        "id": "166732"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2642"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2514"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-22965"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-03-31T00:00:00",
        "db": "CERT/CC",
        "id": "VU#970766"
      },
      {
        "date": "2022-04-01T00:00:00",
        "db": "VULHUB",
        "id": "VHN-411825"
      },
      {
        "date": "2022-04-01T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-22965"
      },
      {
        "date": "2022-04-27T18:19:24",
        "db": "PACKETSTORM",
        "id": "166874"
      },
      {
        "date": "2022-04-27T18:18:11",
        "db": "PACKETSTORM",
        "id": "166872"
      },
      {
        "date": "2022-04-11T17:36:49",
        "db": "PACKETSTORM",
        "id": "166691"
      },
      {
        "date": "2022-04-13T15:01:19",
        "db": "PACKETSTORM",
        "id": "166706"
      },
      {
        "date": "2022-04-13T22:20:55",
        "db": "PACKETSTORM",
        "id": "166715"
      },
      {
        "date": "2022-04-15T15:24:03",
        "db": "PACKETSTORM",
        "id": "166731"
      },
      {
        "date": "2022-04-15T15:24:12",
        "db": "PACKETSTORM",
        "id": "166732"
      },
      {
        "date": "2022-03-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202203-2642"
      },
      {
        "date": "2022-03-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202203-2514"
      },
      {
        "date": "2022-04-01T23:15:13.870000",
        "db": "NVD",
        "id": "CVE-2022-22965"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-05-19T00:00:00",
        "db": "CERT/CC",
        "id": "VU#970766"
      },
      {
        "date": "2023-02-09T00:00:00",
        "db": "VULHUB",
        "id": "VHN-411825"
      },
      {
        "date": "2023-02-09T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-22965"
      },
      {
        "date": "2022-04-02T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202203-2642"
      },
      {
        "date": "2023-06-28T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202203-2514"
      },
      {
        "date": "2025-10-30T19:56:43.110000",
        "db": "NVD",
        "id": "CVE-2022-22965"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "166691"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2514"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Spring Framework Code injection vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2642"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2514"
      }
    ],
    "trust": 1.2
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code injection",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2642"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202203-2514"
      }
    ],
    "trust": 1.2
  }
}

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Das Spring Framework bietet ein Entwicklungsmodell f\u00fcr Java mit Infrastrukturunterst\u00fctzung auf Anwendungsebene.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in VMware Tanzu Spring Framework ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- CISCO Appliance\n- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0033 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0033.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0033 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0033"
      },
      {
        "category": "external",
        "summary": "Rapid7 Blog Post vom 2022-03-30",
        "url": "https://www.rapid7.com/blog/post/2022/03/30/spring4shell-zero-day-vulnerability-in-spring-framework/"
      },
      {
        "category": "external",
        "summary": "Sonatype Blog",
        "url": "https://blog.sonatype.com/new-0-day-spring-framework-vulnerability-confirmed"
      },
      {
        "category": "external",
        "summary": "Artikel von Praetorian",
        "url": "https://www.praetorian.com/blog/spring-core-jdk9-rce/"
      },
      {
        "category": "external",
        "summary": "Spring Cloud Advisory vom 2022-03-30",
        "url": "https://www.springcloud.io/post/2022-03/spring-0day-vulnerability/"
      },
      {
        "category": "external",
        "summary": "Spring Boot 2.6.6 available now vom 2022-03-31",
        "url": "https://spring.io/blog/2022/03/31/spring-boot-2-6-6-available-now"
      },
      {
        "category": "external",
        "summary": "Spring Boot 2.5.12 available now vom 2022-03-31",
        "url": "https://spring.io/blog/2022/03/31/spring-boot-2-5-12-available-now"
      },
      {
        "category": "external",
        "summary": "Spring Framework RCE vom 2022-03-31",
        "url": "https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67 vom 2022-04-02",
        "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67"
      },
      {
        "category": "external",
        "summary": "SonicWall Security Advisory SNWLID-2022-0005 vom 2022-04-02",
        "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005"
      },
      {
        "category": "external",
        "summary": "VMware Security Advisory VMSA-2022-0010 vom 2022-04-02",
        "url": "https://www.vmware.com/security/advisories/VMSA-2022-0010.html"
      },
      {
        "category": "external",
        "summary": "Apache Tomcat Release Notes",
        "url": "https://tomcat.apache.org/"
      },
      {
        "category": "external",
        "summary": "Unify Security Advisory Report OBSO-2204-01 vom 2022-04-04",
        "url": "https://networks.unify.com/security/advisories/OBSO-2204-01.pdf"
      },
      {
        "category": "external",
        "summary": "HCL Article KB0097763 vom 2022-04-06",
        "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0097763"
      },
      {
        "category": "external",
        "summary": "Solarwinds Documentation for Security Event Manager",
        "url": "https://documentation.solarwinds.com/en/success_center/sem/content/release_notes/sem_2022-2_release_notes.htm"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1306 vom 2022-04-11",
        "url": "https://access.redhat.com/errata/RHSA-2022:1306"
      },
      {
        "category": "external",
        "summary": "Cisco Security Advisory CISCO-SA-JAVA-SPRING-RCE-ZX9GUC67 vom 2022-04-12",
        "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1333 vom 2022-04-13",
        "url": "https://access.redhat.com/errata/RHSA-2022:1333"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6571299 vom 2022-04-13",
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-soar-is-affected-but-not-classified-as-vulnerable-to-remote-code-execution-in-spring-framework-cve-2022-22965/"
      },
      {
        "category": "external",
        "summary": "Lenovo Security Advisory LEN-87699 vom 2022-04-13",
        "url": "https://support.lenovo.com/us/en/product_security/LEN-87699"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1360 vom 2022-04-13",
        "url": "https://access.redhat.com/errata/RHSA-2022:1360"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1379 vom 2022-04-15",
        "url": "https://access.redhat.com/errata/RHSA-2022:1379"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1378 vom 2022-04-15",
        "url": "https://access.redhat.com/errata/RHSA-2022:1378"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1626 vom 2022-04-27",
        "url": "https://access.redhat.com/errata/RHSA-2022:1626"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1627 vom 2022-04-27",
        "url": "https://access.redhat.com/errata/RHSA-2022:1627"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6575577 vom 2022-04-28",
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-infosphere-information-server-is-affected-by-a-remote-code-execution-in-spring-framework-cve-2022-22965/"
      },
      {
        "category": "external",
        "summary": "Atlassian Security Advisory JSWSERVER-21350 vom 2022-05-11",
        "url": "https://jira.atlassian.com/browse/JSWSERVER-21350"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2022-114 vom 2022-05-27",
        "url": "https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2022-114/index.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:4880 vom 2022-06-02",
        "url": "https://access.redhat.com/errata/RHSA-2022:4880"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-7165-1 vom 2024-12-18",
        "url": "https://ubuntu.com/security/notices/USN-7165-1"
      }
    ],
    "source_lang": "en-US",
    "title": "VMware Tanzu Spring Framework: Schwachstelle erm\u00f6glicht Ausf\u00fchren von beliebigem Programmcode",
    "tracking": {
      "current_release_date": "2024-12-18T23:00:00.000+00:00",
      "generator": {
        "date": "2024-12-19T09:19:52.335+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2022-0033",
      "initial_release_date": "2022-03-30T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-03-30T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-03-31T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE und neue Updates aufgenommen"
        },
        {
          "date": "2022-04-03T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Tomcat, Cisco, SonicWall und VMware aufgenommen"
        },
        {
          "date": "2022-04-04T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Informationen von Unify aufgenommen"
        },
        {
          "date": "2022-04-05T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von HCL aufgenommen"
        },
        {
          "date": "2022-04-06T22:00:00.000+00:00",
          "number": "6",
          "summary": "Anpassung"
        },
        {
          "date": "2022-04-10T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2022-04-11T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-04-12T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Informationen von Cisco und Lenovo aufgenommen"
        },
        {
          "date": "2022-04-13T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-04-18T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-04-26T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-04-27T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2022-05-11T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Atlassian aufgenommen"
        },
        {
          "date": "2022-05-26T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2022-06-01T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-12-18T23:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        }
      ],
      "status": "final",
      "version": "17"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.0.62",
                "product": {
                  "name": "Apache Tomcat \u003c9.0.62",
                  "product_id": "T022513"
                }
              },
              {
                "category": "product_version",
                "name": "9.0.62",
                "product": {
                  "name": "Apache Tomcat 9.0.62",
                  "product_id": "T022513-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:9.0.62"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c10.0.20",
                "product": {
                  "name": "Apache Tomcat \u003c10.0.20",
                  "product_id": "T022514"
                }
              },
              {
                "category": "product_version",
                "name": "10.0.20",
                "product": {
                  "name": "Apache Tomcat 10.0.20",
                  "product_id": "T022514-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:10.0.20"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.5.78",
                "product": {
                  "name": "Apache Tomcat \u003c8.5.78",
                  "product_id": "T022515"
                }
              },
              {
                "category": "product_version",
                "name": "8.5.78",
                "product": {
                  "name": "Apache Tomcat 8.5.78",
                  "product_id": "T022515-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:apache:tomcat:8.5.78"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Tomcat"
          }
        ],
        "category": "vendor",
        "name": "Apache"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Atlassian Jira Software",
            "product": {
              "name": "Atlassian Jira Software",
              "product_id": "T015027",
              "product_identification_helper": {
                "cpe": "cpe:/a:atlassian:jira_software:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Atlassian"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Cisco Meeting Server",
            "product": {
              "name": "Cisco Meeting Server",
              "product_id": "T018748",
              "product_identification_helper": {
                "cpe": "cpe:/a:cisco:meeting_server:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Cisco"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "HCL Domino",
            "product": {
              "name": "HCL Domino",
              "product_id": "777623",
              "product_identification_helper": {
                "cpe": "cpe:/a:hcltech:domino:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "HCL Notes",
            "product": {
              "name": "HCL Notes",
              "product_id": "T022546",
              "product_identification_helper": {
                "cpe": "cpe:/a:hcltech:notes:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "HCL"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Energy Manager",
                "product": {
                  "name": "Lenovo XClarity Energy Manager",
                  "product_id": "T022659",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:lenovo:xclarity:::energy_manager"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "XClarity"
          }
        ],
        "category": "vendor",
        "name": "Lenovo"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c4.1.6",
                "product": {
                  "name": "Shibboleth Identity Provider \u003c4.1.6",
                  "product_id": "T022497"
                }
              },
              {
                "category": "product_version",
                "name": "4.1.6",
                "product": {
                  "name": "Shibboleth Identity Provider 4.1.6",
                  "product_id": "T022497-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:shibboleth:identity_provider:4.1.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Identity Provider"
          }
        ],
        "category": "vendor",
        "name": "Shibboleth"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SolarWinds Security Event Manager",
            "product": {
              "name": "SolarWinds Security Event Manager",
              "product_id": "T022592",
              "product_identification_helper": {
                "cpe": "cpe:/a:solarwinds:security_event_manager:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SolarWinds"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.5.12",
                "product": {
                  "name": "VMware Tanzu Spring Boot \u003c2.5.12",
                  "product_id": "T022487"
                }
              },
              {
                "category": "product_version",
                "name": "2.5.12",
                "product": {
                  "name": "VMware Tanzu Spring Boot 2.5.12",
                  "product_id": "T022487-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_boot:2.5.12"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c2.6.6",
                "product": {
                  "name": "VMware Tanzu Spring Boot \u003c2.6.6",
                  "product_id": "T022488"
                }
              },
              {
                "category": "product_version",
                "name": "2.6.6",
                "product": {
                  "name": "VMware Tanzu Spring Boot 2.6.6",
                  "product_id": "T022488-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_boot:2.6.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spring Boot"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.3.18",
                "product": {
                  "name": "VMware Tanzu Spring Framework \u003c5.3.18",
                  "product_id": "T022485"
                }
              },
              {
                "category": "product_version",
                "name": "5.3.18",
                "product": {
                  "name": "VMware Tanzu Spring Framework 5.3.18",
                  "product_id": "T022485-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_framework:5.3.18"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c5.2.20",
                "product": {
                  "name": "VMware Tanzu Spring Framework \u003c5.2.20",
                  "product_id": "T022486"
                }
              },
              {
                "category": "product_version",
                "name": "5.2.20",
                "product": {
                  "name": "VMware Tanzu Spring Framework 5.2.20",
                  "product_id": "T022486-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:vmware_tanzu:spring_framework:5.2.20"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spring Framework"
          }
        ],
        "category": "vendor",
        "name": "VMware Tanzu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-22965",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle im VMware Tanzu Spring Framework bei der Nutzung von JDK ab Version 9 bez\u00fcglich bez\u00fcglich \"spring-beans-*.jar\" Dateien. Unter bestimmten Konfigurationen kann ein entfernter anonymer Angreifer \u00fcber speziell manipulierte HTTP-Anfragen an ein anf\u00e4lliges System beliebigen Code zur Ausf\u00fchrung bringen."
        }
      ],
      "product_status": {
        "known_affected": [
          "67646",
          "T015027",
          "T022514",
          "T022515",
          "T022659",
          "T022488",
          "T000126",
          "T022546",
          "T022513",
          "T018748",
          "T022485",
          "T022486",
          "T022497",
          "777623",
          "T022487",
          "T022592"
        ]
      },
      "release_date": "2022-03-30T22:00:00.000+00:00",
      "title": "CVE-2022-22965"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "MySQL ist ein Open Source Datenbankserver von Oracle.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle MySQL ausnutzen, um die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit zu gef\u00e4hrden.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- MacOS X\n- NetApp Appliance\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0169 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0169.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0169 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0169"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5490-1 vom 2022-06-21",
        "url": "https://ubuntu.com/security/notices/USN-5490-1"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:2003-1 vom 2022-06-07",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-June/011247.html"
      },
      {
        "category": "external",
        "summary": "Oracle Critical Patch Update April 2022 - Appendix Oracle MySQL vom 2022-04-19",
        "url": "https://www.oracle.com/security-alerts/cpuapr2022.html#AppendixMSQL"
      },
      {
        "category": "external",
        "summary": "NetApp Security Advisory NTAP-20220429-0005 vom 2022-04-29",
        "url": "https://security.netapp.com/advisory/ntap-20220429-0005/"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5400-1 vom 2022-05-03",
        "url": "https://ubuntu.com/security/notices/USN-5400-1"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5400-2 vom 2022-05-04",
        "url": "https://ubuntu.com/security/notices/USN-5400-2"
      },
      {
        "category": "external",
        "summary": "Ubuntu Security Notice USN-5400-3 vom 2022-05-05",
        "url": "https://ubuntu.com/security/notices/USN-5400-3"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2022-098 vom 2022-07-21",
        "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-098.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6306 vom 2022-09-01",
        "url": "https://access.redhat.com/errata/RHSA-2022:6306"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6518 vom 2022-09-14",
        "url": "https://access.redhat.com/errata/RHSA-2022:6518"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6590 vom 2022-09-21",
        "url": "https://access.redhat.com/errata/RHSA-2022:6590"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-6590 vom 2022-09-22",
        "url": "https://linux.oracle.com/errata/ELSA-2022-6590.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:1040-3 vom 2022-10-06",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-October/012505.html"
      },
      {
        "category": "external",
        "summary": "Juniper Security Bulletin",
        "url": "https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-Space-Multiple-vulnerabilities-resolved-in-22-2R1-release"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Bulletin-October 2022 vom 2022-10-18",
        "url": "https://www.oracle.com/security-alerts/linuxbulletinoct2022.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7119 vom 2022-10-25",
        "url": "https://access.redhat.com/errata/RHSA-2022:7119"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-7119 vom 2022-10-27",
        "url": "https://linux.oracle.com/errata/ELSA-2022-7119.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2022-165 vom 2022-11-04",
        "url": "https://alas.aws.amazon.com/AL2022/ALAS-2022-165.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7464 vom 2022-11-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:7464"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7970 vom 2022-11-15",
        "url": "https://access.redhat.com/errata/RHSA-2022:7970"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-7970 vom 2022-11-22",
        "url": "https://linux.oracle.com/errata/ELSA-2022-7970.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:8860 vom 2022-12-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:8860"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:8847 vom 2022-12-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:8847"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:8893 vom 2022-12-15",
        "url": "https://access.redhat.com/errata/RHSA-2022:8893"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2023-1931 vom 2023-02-06",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1931.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS-2023-1676 vom 2023-02-06",
        "url": "https://alas.aws.amazon.com/ALAS-2023-1676.html"
      },
      {
        "category": "external",
        "summary": "Amazon Linux Security Advisory ALAS2-2023-1948 vom 2023-02-22",
        "url": "https://alas.aws.amazon.com/AL2/ALAS-2023-1948.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:3433 vom 2024-05-28",
        "url": "https://access.redhat.com/errata/RHSA-2024:3433"
      }
    ],
    "source_lang": "en-US",
    "title": "Oracle MySQL: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-05-28T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:27:04.345+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2022-0169",
      "initial_release_date": "2022-04-19T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-04-19T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-05-01T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von NetApp aufgenommen"
        },
        {
          "date": "2022-05-03T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2022-05-04T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2022-05-05T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2022-06-07T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-06-21T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Ubuntu aufgenommen"
        },
        {
          "date": "2022-07-20T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2022-09-01T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-09-14T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-09-20T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-09-21T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2022-10-06T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-10-12T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2022-10-18T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates aufgenommen"
        },
        {
          "date": "2022-10-25T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-10-26T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2022-11-06T23:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2022-11-08T23:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-11-15T23:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-11-21T23:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2022-12-07T23:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-12-15T23:00:00.000+00:00",
          "number": "23",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-02-06T23:00:00.000+00:00",
          "number": "24",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2023-02-22T23:00:00.000+00:00",
          "number": "25",
          "summary": "Neue Updates von Amazon aufgenommen"
        },
        {
          "date": "2024-05-28T22:00:00.000+00:00",
          "number": "26",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "26"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Amazon Linux 2",
            "product": {
              "name": "Amazon Linux 2",
              "product_id": "398363",
              "product_identification_helper": {
                "cpe": "cpe:/o:amazon:linux_2:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Amazon"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c22.2R1",
                "product": {
                  "name": "Juniper Junos Space \u003c22.2R1",
                  "product_id": "T003343"
                }
              }
            ],
            "category": "product_name",
            "name": "Junos Space"
          }
        ],
        "category": "vendor",
        "name": "Juniper"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "NetApp ActiveIQ Unified Manager",
            "product": {
              "name": "NetApp ActiveIQ Unified Manager",
              "product_id": "T016960",
              "product_identification_helper": {
                "cpe": "cpe:/a:netapp:active_iq_unified_manager:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "NetApp"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=8.0.29",
                "product": {
                  "name": "Oracle MySQL \u003c=8.0.29",
                  "product_id": "T022871"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=8.0.28",
                "product": {
                  "name": "Oracle MySQL \u003c=8.0.28",
                  "product_id": "T022872"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=5.7.37",
                "product": {
                  "name": "Oracle MySQL \u003c=5.7.37",
                  "product_id": "T022873"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=7.4.35",
                "product": {
                  "name": "Oracle MySQL \u003c=7.4.35",
                  "product_id": "T022874"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=7.5.25",
                "product": {
                  "name": "Oracle MySQL \u003c=7.5.25",
                  "product_id": "T022875"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=7.6.21",
                "product": {
                  "name": "Oracle MySQL \u003c=7.6.21",
                  "product_id": "T022876"
                }
              }
            ],
            "category": "product_name",
            "name": "MySQL"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat OpenShift",
            "product": {
              "name": "Red Hat OpenShift",
              "product_id": "367115",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Ubuntu Linux",
            "product": {
              "name": "Ubuntu Linux",
              "product_id": "T000126",
              "product_identification_helper": {
                "cpe": "cpe:/o:canonical:ubuntu_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Ubuntu"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-22570",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2021-22570"
    },
    {
      "cve": "CVE-2021-41184",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2021-41184"
    },
    {
      "cve": "CVE-2021-42340",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2021-42340"
    },
    {
      "cve": "CVE-2021-44832",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2021-44832"
    },
    {
      "cve": "CVE-2022-0778",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-0778"
    },
    {
      "cve": "CVE-2022-21412",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21412"
    },
    {
      "cve": "CVE-2022-21413",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21413"
    },
    {
      "cve": "CVE-2022-21414",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21414"
    },
    {
      "cve": "CVE-2022-21415",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21415"
    },
    {
      "cve": "CVE-2022-21417",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21417"
    },
    {
      "cve": "CVE-2022-21418",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21418"
    },
    {
      "cve": "CVE-2022-21423",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21423"
    },
    {
      "cve": "CVE-2022-21425",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21425"
    },
    {
      "cve": "CVE-2022-21427",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21427"
    },
    {
      "cve": "CVE-2022-21435",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21435"
    },
    {
      "cve": "CVE-2022-21436",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21436"
    },
    {
      "cve": "CVE-2022-21437",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21437"
    },
    {
      "cve": "CVE-2022-21438",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21438"
    },
    {
      "cve": "CVE-2022-21440",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21440"
    },
    {
      "cve": "CVE-2022-21444",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21444"
    },
    {
      "cve": "CVE-2022-21451",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21451"
    },
    {
      "cve": "CVE-2022-21452",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21452"
    },
    {
      "cve": "CVE-2022-21454",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21454"
    },
    {
      "cve": "CVE-2022-21457",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21457"
    },
    {
      "cve": "CVE-2022-21459",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21459"
    },
    {
      "cve": "CVE-2022-21460",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21460"
    },
    {
      "cve": "CVE-2022-21462",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21462"
    },
    {
      "cve": "CVE-2022-21478",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21478"
    },
    {
      "cve": "CVE-2022-21479",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21479"
    },
    {
      "cve": "CVE-2022-21482",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21482"
    },
    {
      "cve": "CVE-2022-21483",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21483"
    },
    {
      "cve": "CVE-2022-21484",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21484"
    },
    {
      "cve": "CVE-2022-21485",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21485"
    },
    {
      "cve": "CVE-2022-21486",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21486"
    },
    {
      "cve": "CVE-2022-21489",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21489"
    },
    {
      "cve": "CVE-2022-21490",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-21490"
    },
    {
      "cve": "CVE-2022-22965",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-22965"
    },
    {
      "cve": "CVE-2022-23181",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-23181"
    },
    {
      "cve": "CVE-2022-23305",
      "notes": [
        {
          "category": "description",
          "text": "In Oracle MySQL existieren mehrere Schwachstellen. Durch Ausnutzung dieser Schwachstellen kann ein entfernter, anonymer Angreifer die Vertraulichkeit, Integrit\u00e4t und Verf\u00fcgbarkeit gef\u00e4hrden. F\u00fcr die Ausnutzung einiger dieser Schwachstellen ist keine Benutzerinteraktion notwendig. Oracle ver\u00f6ffentlicht keine weiteren Details zu diesen Schwachstellen (au\u00dfer der Information in der Risiko Matrix im Oracle Advisory zum Critical Patch Update, siehe Link unten in diesem Advisory). Aufgrund der knappen Informationslage erfolgt die Bewertung der Schadensh\u00f6he ausschlie\u00dflich auf Basis der CVSS Impact Matrix. Der Maximalwert f\u00fcr diese Produkte ist \"HIGH\" f\u00fcr \"Confidentiality\", \"Integrity\" und \"Availability\" \u00fcber alle Schwachstellen aggregiert und bewirkt damit eine Bewertung mit dem Wert \"HOCH\" f\u00fcr die Schadensh\u00f6he."
        }
      ],
      "product_status": {
        "known_affected": [
          "T003343",
          "T002207",
          "67646",
          "T000126",
          "367115",
          "398363",
          "T004914",
          "T016960"
        ],
        "last_affected": [
          "T022873",
          "T022874",
          "T022875",
          "T022876",
          "T022871",
          "T022872"
        ]
      },
      "release_date": "2022-04-19T22:00:00.000+00:00",
      "title": "CVE-2022-23305"
    }
  ]
}