Code Injection in Apache Calcite Avatica - CVE-2022-36364

Vulnerability identifier: #VU65864

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-36364

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in JDBC driver, which creates HTTP client instances based on class names provided via "httpclient_impl" connection property. The driver does not verify if the class implements the expected interface before instantiating it. A remote user with ability to control JDBC connection parameters can inject arbitrary class name and execute code on the system.

Apache Calcite Avatica
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Log Analysis
Splunk Enterprise
IBM Qradar SIEM
IBM Cognos Analytics

Install updates from vendor's website.

Apache Calcite Avatica - update to 1.22.0
Log Analysis - addressed in versions 1.3.7.2 IF001, 1.3.7.2 IF002
Splunk Enterprise - addressed in versions 9.0.9, 9.1.4, 9.2.1
DB2 on Cloud Pak for Data - update to 4.8.5
DB2 Warehouse on Cloud Pak for Data - update to 4.8.5
IBM Qradar SIEM - addressed in versions 7.4.3 Fix Pack 9, 7.5.0 Update Pack 5
IBM Cognos Analytics - addressed in versions 11.1.7.6, 11.2.4

• https://seclists.org/oss-sec/2022/q3/75

• Code injection in Apache Calcite Avatica JDBC driver
• Code injection in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data
• Splunk Enterprise update for third-party components