Input validation error in Spring Framework - CVE-2021-22096

Vulnerability identifier: #VU61720

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-22096

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to modify existing log records.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and inject arbitrary records into log files.

Spring Framework
rhv-log-collector-analyzer (Red Hat package)
ovirt-engine-ui-extensions (Red Hat package)
ovirt-engine-extension-aaa-ldap (Red Hat package)
vdsm-jsonrpc-java (Red Hat package)
ovirt-web-ui (Red Hat package)
ovirt-log-collector (Red Hat package)
ovirt-engine (Red Hat package)
ovirt-engine-dwh (Red Hat package)
unboundid-ldapsdk (Red Hat package)
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Service Communication Proxy
watsonx.data
Red Hat Virtualization Manager
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
Red Hat Decision Manager
IBM Rational Build Forge
IBM Common Licensing
Autodesk Infraworks
IBM Sterling B2B Integrator
Integration Designer
Storage Copy Data Management
IBM Tivoli Netcool Configuration Manager
MobileFirst Platform
IBM Engineering Requirements Management DOORS Next
Storage Protect Plus Server
IBM Cognos Controller

Install updates from vendor's website.

Spring Framework - addressed in versions 5.2.18, 5.3.12
rhv-log-collector-analyzer (Red Hat package) - update to 1.0.15-1.el8ev
ovirt-engine-ui-extensions (Red Hat package) - update to 1.3.5-1.el8ev
ovirt-engine-extension-aaa-ldap (Red Hat package) - update to 1.4.6-1.el8ev
vdsm-jsonrpc-java (Red Hat package) - update to 1.7.2-1.el8ev
ovirt-web-ui (Red Hat package) - update to 1.9.1-1.el8ev
watsonx.data - update to 2.1
ovirt-log-collector (Red Hat package) - update to 4.4.7-2.el8ev
ovirt-engine (Red Hat package) - update to 4.5.2.4-0.1.el8ev
ovirt-engine-dwh (Red Hat package) - update to 4.5.4-1.el8ev
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.12.1
Red Hat Decision Manager - update to 7.12.1
IBM Rational Build Forge - update to 8.0.0.29
Autodesk Infraworks - addressed in versions 2021.2 Hotfix 9, 2023.1 Hotfix 1
Storage Copy Data Management - update to 2.2.26.0
IBM Sterling B2B Integrator - addressed in versions 6.0.3.7, 6.1.0.6, 6.1.1.2, 6.1.2.0
unboundid-ldapsdk (Red Hat package) - update to 6.0.4-1.el8ev
IBM Tivoli Netcool Configuration Manager - update to 6.4.2.18
MobileFirst Platform - update to 8.0.0.0-MFPF-IF202301121031
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.7
Storage Protect Plus Server - update to 10.1.16.1
IBM Cognos Controller - addressed in versions 10.4.1.0.15, 10.4.2.0.2

• https://tanzu.vmware.com/security/cve-2021-22096
• https://security.netapp.com/advisory/ntap-20211125-0005/

• Log tampering in Spring Framework
• Multiple vulnerabilities in Red Hat Process Automation Manager
• Multiple vulnerabilities in Red Hat Decision Manager
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in IBM Common Licensing
• Multiple vulnerabilities in Red Hat Virtualization Manager
• Multiple vulnerabilities in IBM Sterling B2B Integrator
• Multiple vulnerabilities in Autodesk InfraWorks
• Input validation error in IBM Tivoli Netcool Configuration Manager
• Multiple vulnerabilities in IBM Cognos Controller
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Multiple vulnerabilities in IBM Storage Protect Plus Server
• Multiple vulnerabilities in IBM Integration Designer
• Multiple vulnerabilities in IBM MobileFirst Platform Foundation
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in IBM Rational Build Forge