SB2022032405 - Multiple vulnerabilities in Cloudera Data Platform Private Cloud Base for IBM
Published: March 24, 2022 Updated: April 14, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Deserialization of Untrusted Data (CVE-ID: CVE-2022-23302)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data in JMSSink. A remote attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests and execute arbitrary code on the target system.
Note, a non-default configuration with support for JMSSink is required to exploit this vulnerability.
2) Code Injection (CVE-ID: CVE-2021-44832)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation. A remote user with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code.
3) Infinite loop (CVE-ID: CVE-2021-45105)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop within the StrSubstitutor class. A remote attacker can pass specially crafted input to the application, consume all available system resources and cause denial of service conditions.
Payload example: ${${::-${::-$${::-j}}}}
4) Incorrect default permissions (CVE-ID: CVE-2022-21704)
CWE-ID: CWE-276 - Incorrect Default Permissions
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect default permissions for log files created by the file, fileSync and dateFile appenders. A local user with access to the system can view contents of files and gain access to sensitive information.
5) Code Injection (CVE-ID: CVE-2021-45046)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber
The vulnerability allows a remote attacker to compromise the affected system.
The
vulnerability exists due to incomplete patch in Apache Log4j 2.15.0 for
a code injection vulnerability #VU58816 (CVE-2021-44228) in certain
non-default configurations. A remote attacker with control over Thread
Context Map (MDC) input data when the logging configuration uses a
non-default Pattern Layout with either a Context Lookup (for example,
$${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) can
pass malicious data using a JNDI Lookup pattern and perform a denial of
service (DoS) attack, exfiltrate data or execute arbitrary code.
Later discovery demonstrates a remote code execution on macOS but no other tested environments.
6) SQL injection (CVE-ID: CVE-2022-23305)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in the JDBCAppender. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Note, a non-default configuration with enabled JDBCAppender is required to exploit the vulnerability.
Remediation
Install update from vendor's website.