Deserialization of Untrusted Data in Snakeyaml - CVE-2022-1471

Vulnerability identifier: #VU70385

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1471

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data within the SnakeYaml's Constructor() class. A remote attacker can pass specially crafted yaml content to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Snakeyaml
Oracle Linux
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
PowerStore 9000X
PowerStore 7000X
PowerStore 5000X
PowerStore 3000X
PowerStore 1000X
PowerStoreX OS
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
ObjectScale
DataStax Hyper-Converged Database
IBM Watson Machine Learning Accelerator
Oracle Utilities Network Management System
DB2 Data Management Console
Guardium Data Security Center (GDSC)
Planning Analytics Cartridge for Cloud Pak for Data
Oracle Business Intelligence Enterprise Edition
Automation for Jira
CICS Transaction Gateway Desktop Edition
Oracle Communications Network Charging and Control
Oracle FLEXCUBE Investor Servicing
Oracle Banking Digital Experience
Integration Designer
Oracle Retail Xstore Point of Service
Oracle Siebel CRM
Db2 Graph
IBM i Modernization Engine for Lifecycle Integration
IBM Planning Analytics Workspace
Cloud Pak for Network Automation
UrbanCode Build
IBM Business Automation Manager Open Editions
Maximo Data Loader
Dell Data Protection Central
Robotic Process Automation for Cloud Pak
WebSphere Service Registry and Repository
TorchServe
Migration Toolkit for Runtimes
IBM Process Mining
Oracle Banking Deposits and Lines of Credit Servicing
Oracle Banking Party Management
Oracle Banking Loans Servicing
Jira Service Management Data Center
Jira Service Management Server
IBM Sterling B2B Integrator
Confluence Data Center
Oracle Communications Unified Inventory Management
Bitbucket Data Center
Automation for Jira - Server Lite
Oracle Financial Services Model Management and Governance
IBM Maximo Application Suite
Oracle SD-WAN Edge
Jira Software Data Center
Oracle Banking APIs
Oracle Communications Network Analytics Data Director
Log Analysis
Netcool Operations Insight
Red Hat build of Quarkus
IBM Cloud Transformation Advisor
QRadar User Behavior Analytics
IBM Watson Assistant for IBM Cloud Pak for Data
Data Replication on Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Match 360
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
App Connect Enterprise Certified Container
IBM Global High Availability Mailbox
Red Hat Satellite
UCD - IBM UrbanCode Deploy
IBM Spectrum Symphony
IBM Workload Scheduler
IBM Business Automation Workflow
IBM Cloud Pak for Business Automation
IBM Observability with Instana
AMQ Clients
Red Hat Openshift Application Runtimes
Red Hat OpenShift Container Platform
IBM Disconnected Log Collector
API Gateway
JBoss Enterprise Application Platform
Bitbucket Server
AMQ Streams
API Manager
Red Hat OpenShift GitOps
IBM Db2 Web Query for i
Oracle Utilities Testing Accelerator
Oracle SOA Suite
IBM Cloud Pak System
Oracle Healthcare Translational Research
Oracle Communications Pricing Design Center
Oracle Communications Convergent Charging Controller
Oracle Hospitality Cruise Shipboard Property Management System
OpenShift Developer Tools and Services
Communications Unified Assurance
Communications Service Catalog and Design
Oracle Communications Billing and Revenue Management
Voice Gateway
SecureTransport
Confluence Server
Red Hat Single Sign-On
Red Hat Process Automation Manager (formerly JBoss BPM Suite)
PeopleSoft Enterprise PeopleTools
Operational Decision Manager
IBM Cognos Analytics
JD Edwards EnterpriseOne Orchestrator
IBM Security Verify Access
Jira Software Server
Oracle FLEXCUBE Core Banking
Cloud Pak for Security (CP4S)
Oracle Communications BRM - Elastic Charging Engine
IBM DB2
IBM InfoSphere Information Server
eap7-jboss-el (Red Hat package)
eap7-apache-mime4j (Red Hat package)
prometheus-jmx-exporter
prometheus-jmx-exporter-openjdk11
prometheus-jmx-exporter (Red Hat package)
eap7-activemq-artemis-native (Red Hat package)
eap7-artemis-native (Red Hat package)
eap7-artemis-wildfly-integration (Red Hat package)
eap7-wildfly-http-client (Red Hat package)
eap7-jettison (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-velocity (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-undertow-jastow (Red Hat package)
eap7-undertow (Red Hat package)
eap7-picketlink-federation (Red Hat package)
eap7-jackson-databind (Red Hat package)
eap7-jackson-core (Red Hat package)
eap7-jackson-modules-java8 (Red Hat package)
eap7-jackson-annotations (Red Hat package)
eap7-jackson-jaxrs-providers (Red Hat package)
eap7-jackson-modules-base (Red Hat package)
jenkins (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-apache-cxf (Red Hat package)
eap7-hal-console (Red Hat package)
eap7-jbossws-spi (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
python-sushy (Red Hat package)
eap7-netty (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
jenkins-2-plugins (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift (Red Hat package)
openshift-ansible (Red Hat package)
openshift-kuryr (Red Hat package)
openshift-clients (Red Hat package)
eap7-jbossws-cxf (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-infinispan (Red Hat package)
eap7-jboss-metadata (Red Hat package)
rh-sso7-keycloak (Red Hat package)
watsonx.data
Red Hat build of Eclipse Vert.x
IBM Spectrum Scale

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

API Gateway - update to May 2023
API Manager - update to May 2023
TorchServe - update to 0.8.2
Migration Toolkit for Runtimes - update to 1.0.1
ObjectScale - update to 1.3.0
DataStax Hyper-Converged Database - update to 1.2.5
IBM Process Mining - update to 1.14.0.0
IBM Cloud Pak System - update to 2.3.3.6
DB2 Data Management Console - update to 3.1.13
Guardium Data Security Center (GDSC) - update to 3.6.1
Red Hat OpenShift Container Platform - addressed in versions 4.9.56, 4.10.52
Jira Service Management Data Center - addressed in versions 5.4.14, 5.11.2, 5.12.0, 11.3.4
Jira Service Management Server - addressed in versions 5.4.14, 5.11.2, 5.12.0
SecureTransport - update to 5.5-20230330
IBM Sterling B2B Integrator - addressed in versions 6.0.3.9, 6.1.0.8, 6.1.2.3, 6.2.0.0
Confluence Data Center - addressed in versions 7.13.18, 7.19.10, 8.3.1, 8.4.5, 8.5.4, 8.6.2, 8.7.1, 9.2.19, 10.2.10
Confluence Server - addressed in versions 7.13.18, 7.19.10, 8.3.1, 8.4.5, 8.5.4
JBoss Enterprise Application Platform - addressed in versions 7.1.9, 7.3.12, 7.4.10
Red Hat Single Sign-On - update to 7.6.2
Red Hat Process Automation Manager (formerly JBoss BPM Suite) - update to 7.13.5
Bitbucket Data Center - addressed in versions 7.21.16, 8.8.7, 8.9.4, 8.10.4, 8.11.3, 8.12.1, 8.13.0, 8.14.0, 8.15.0, 8.16.0
Bitbucket Server - addressed in versions 7.21.16, 8.8.7, 8.9.4, 8.10.4, 8.11.3, 8.12.1, 8.13.0, 8.14.0
Automation for Jira - Server Lite - addressed in versions 8.2.4, 9.0.2
Automation for Jira - addressed in versions 8.2.4, 9.0.2
IBM Maximo Application Suite - addressed in versions 8.8.8, 8.9.4, 8.10.1, 8.10.6, 8.11.1
JD Edwards EnterpriseOne Orchestrator - update to 9.2.7.4
Jira Software Server - addressed in versions 9.4.14, 9.11.2, 9.12.0
Jira Software Data Center - update to 11.3.4
Oracle Siebel CRM - update to 23.5
eap7-jboss-el (Red Hat package) - addressed in versions api_3.0_spec-2.0.1-1.Final_redhat_00001.1.el7eap, api_3.0_spec-2.0.1-1.Final_redhat_00001.1.el8eap, api_3.0_spec-2.0.1-1.Final_redhat_00001.1.el9eap
eap7-apache-mime4j (Red Hat package) - addressed in versions 0.8.9-1.redhat_00001.1.el7eap, 0.8.9-1.redhat_00001.1.el8eap, 0.8.9-1.redhat_00001.1.el9eap
prometheus-jmx-exporter - update to 0.12.0-9
prometheus-jmx-exporter-openjdk11 - update to 0.12.0-9
prometheus-jmx-exporter (Red Hat package) - update to 0.12.0-9.el8_7
Db2 Graph - addressed in versions 1.0.0.1774-amd64, 1.0.0.1774-s390x, 1.0.0.1774-ppcle, 1.0.0.1775-amd64, 1.0.0.1775-s390x, 1.0.0.1775-ppcle
eap7-activemq-artemis-native (Red Hat package) - addressed in versions 1.0.2-3.redhat_00004.1.el7eap, 1.0.2-3.redhat_00004.1.el8eap, 1.0.2-3.redhat_00004.1.el9eap
eap7-artemis-native (Red Hat package) - addressed in versions 1.0.2-4.redhat_00004.1.el7eap, 1.0.2-4.redhat_00004.1.el8eap, 1.0.2-4.redhat_00004.1.el9eap
eap7-artemis-wildfly-integration (Red Hat package) - addressed in versions 1.0.7-1.redhat_00001.1.el7eap, 1.0.7-1.redhat_00001.1.el8eap, 1.0.7-1.redhat_00001.1.el9eap
Voice Gateway - addressed in versions 1.0.8.2, 1.0.8.6
eap7-wildfly-http-client (Red Hat package) - addressed in versions 1.1.16-1.Final_redhat_00002.1.el7eap, 1.1.16-1.Final_redhat_00002.1.el8eap, 1.1.16-1.Final_redhat_00002.1.el9eap
Log Analysis - update to 1.3.7.2 IF003A
eap7-jettison (Red Hat package) - addressed in versions 1.3.8-2.redhat_00002.1.ep7.el7, 1.5.2-2.redhat_00002.1.el7eap
IBM i Modernization Engine for Lifecycle Integration - update to 1.4.3
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.11-1.Final_redhat_00001.1.el7eap, 1.5.11-1.Final_redhat_00001.1.el8eap, 1.5.11-1.Final_redhat_00001.1.el9eap
Netcool Operations Insight - update to 1.6.11
eap7-velocity (Red Hat package) - update to 1.7.0-3.redhat_00006.1.ep7.el7
IBM Disconnected Log Collector - update to 1.8.3
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-26.Final_redhat_00025.1.el7eap, 1.10.0-26.Final_redhat_00025.1.el8eap, 1.10.0-26.Final_redhat_00025.1.el9eap
Cloud Pak for Security (CP4S) - update to 1.10.10.0
eap7-snakeyaml (Red Hat package) - addressed in versions 1.33.0-1.SP1_redhat_00001.1.el7eap, 1.33.0-1.SP1_redhat_00001.1.ep7.el7, 1.33.0-2.SP1_redhat_00001.1.el7eap, 1.33.0-2.SP1_redhat_00001.1.el8eap, 1.33.0-2.SP1_redhat_00001.1.el9eap
watsonx.data - addressed in versions 2.0.1, 2.0.3
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.14-1.Final_redhat_00001.1.el7eap, 2.0.14-1.Final_redhat_00001.1.el8eap, 2.0.14-1.Final_redhat_00001.1.el9eap
IBM Planning Analytics Workspace - update to 2.0.87
eap7-undertow (Red Hat package) - addressed in versions 2.2.23-1.SP2_redhat_00001.1.el7eap, 2.2.23-1.SP2_redhat_00001.1.el8eap, 2.2.23-1.SP2_redhat_00001.1.el9eap
Cloud Pak for Network Automation - update to 2.4.3
AMQ Streams - update to 2.5.0
eap7-picketlink-federation (Red Hat package) - addressed in versions 2.5.5-22.SP12_redhat_00012.1.el7eap, 2.5.5-22.SP12_redhat_00012.1.el8eap, 2.5.5-22.SP12_redhat_00012.1.el9eap
Red Hat build of Quarkus - addressed in versions 2.7.7, 2.13.7
eap7-jackson-databind (Red Hat package) - addressed in versions 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7, 2.10.4-4.redhat_00004.1.el7eap
eap7-jackson-core (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-modules-java8 (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-annotations (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-jaxrs-providers (Red Hat package) - update to 2.10.4-2.redhat_00004.1.el7eap
eap7-jackson-modules-base (Red Hat package) - update to 2.10.4-4.redhat_00004.1.el7eap
jenkins (Red Hat package) - addressed in versions 2.361.1.1675406172-1.el8, 2.361.1.1675668150-1.el8, 2.387.1.1683009763-3.el8, 2.414.3.1698298955-3.el8, 2.426.3.1706516929-3.el8
eap7-resteasy (Red Hat package) - addressed in versions 3.0.27-1.Final_redhat_00001.1.ep7.el7, 3.11.6-1.Final_redhat_00001.1.el7eap, 3.15.5-1.Final_redhat_00001.1.el7eap, 3.15.5-1.Final_redhat_00001.1.el8eap, 3.15.5-1.Final_redhat_00001.1.el9eap
eap7-apache-cxf (Red Hat package) - update to 3.1.16-4.redhat_00003.1.ep7.el7
PowerStoreX OS - update to 3.2.1.6-2476179
eap7-hal-console (Red Hat package) - update to 3.2.17-1.Final_redhat_00001.1.el7eap
eap7-jbossws-spi (Red Hat package) - addressed in versions 3.4.0-2.Final_redhat_00001.1.el7eap, 3.4.0-2.Final_redhat_00001.1.el8eap, 3.4.0-2.Final_redhat_00001.1.el9eap
IBM Cloud Transformation Advisor - update to 3.5.2
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.50-1.Final_redhat_00001.1.el7eap, 4.0.50-1.Final_redhat_00001.1.el8eap, 4.0.50-1.Final_redhat_00001.1.el9eap
python-sushy (Red Hat package) - update to 4.1.5-0.20221125154417.ff95176.el8
QRadar User Behavior Analytics - update to 4.1.12
eap7-netty (Red Hat package) - addressed in versions 4.1.63-1.Final_redhat_00002.1.ep7.el7, 4.1.63-4.Final_redhat_00002.1.el7eap, 4.1.86-1.Final_redhat_00001.1.el7eap, 4.1.86-1.Final_redhat_00001.1.el8eap, 4.1.86-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.86-1.Final_redhat_00001.1.el7eap, 4.1.86-1.Final_redhat_00001.1.el8eap, 4.1.86-1.Final_redhat_00001.1.el9eap
Red Hat build of Eclipse Vert.x - update to 4.3.4
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.6.2
Data Replication on Cloud Pak for Data - update to 4.7.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
IBM Match 360 - update to 4.7.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.7
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7
jenkins-2-plugins (Red Hat package) - addressed in versions 4.9.1675668922-1.el8, 4.10.1675407676-1.el8, 4.11.1683009941-1.el8, 4.11.1698299029-1.el8, 4.11.1706516946-1.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.10.0-202302072053.p0.ga0f9090.assembly.stream.el8
openshift (Red Hat package) - addressed in versions 4.10.0-202302072053.p0.g8a6bfe4.assembly.stream.el7, 4.10.0-202302072053.p0.g8a6bfe4.assembly.stream.el8
openshift-ansible (Red Hat package) - addressed in versions 4.10.0-202302072053.p0.g72c7be6.assembly.stream.el7, 4.10.0-202302072053.p0.g72c7be6.assembly.stream.el8
openshift-kuryr (Red Hat package) - update to 4.10.0-202302072053.p0.gd4f4d9a.assembly.stream.el8
openshift-clients (Red Hat package) - addressed in versions 4.10.0-202302072053.p0.gdaed147.assembly.stream.el7, 4.10.0-202302072053.p0.gdaed147.assembly.stream.el8
App Connect Enterprise Certified Container - addressed in versions 5.0.7, 8.2.0
IBM Spectrum Scale - addressed in versions 5.1.2.10, 5.1.7.0
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.8-1.Final_redhat_00001.1.el7eap, 5.4.8-1.Final_redhat_00001.1.el8eap, 5.4.8-1.Final_redhat_00001.1.el9eap
UrbanCode Build - update to 6.1.7.10
IBM Global High Availability Mailbox - update to 6.2.0.3
Red Hat Satellite - update to 6.13
eap7-wildfly (Red Hat package) - addressed in versions 7.1.9-2.GA_redhat_00002.1.ep7.el7, 7.3.12-3.GA_redhat_00002.1.el7eap, 7.4.10-6.GA_redhat_00002.1.el7eap, 7.4.10-6.GA_redhat_00002.1.el8eap, 7.4.10-6.GA_redhat_00002.1.el9eap
UCD - IBM UrbanCode Deploy - addressed in versions 7.2.3.5, 7.3.2.0
IBM Spectrum Symphony - update to 7.3.2 Fix 601711
IBM Business Automation Manager Open Editions - update to 8.0.5
Maximo Data Loader - update to 8.5.0
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 34, 8.11.0.1 Interim fix 17, 8.11.1 Interim fix 5
IBM Security Verify Access - update to 10.0.7.0
IBM Workload Scheduler - update to 10.1.0.3
eap7-infinispan (Red Hat package) - addressed in versions 11.0.17-1.Final_redhat_00001.1.el7eap, 11.0.17-1.Final_redhat_00001.1.el8eap, 11.0.17-1.Final_redhat_00001.1.el9eap
IBM DB2 - update to 11.1.4.7
IBM Cognos Analytics - addressed in versions 11.1.7 Fix Pack 8, 11.2.4 FP3, 12.0.2
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
eap7-jboss-metadata (Red Hat package) - addressed in versions 13.4.0-1.Final_redhat_00001.1.el7eap, 13.4.0-1.Final_redhat_00001.1.el8eap, 13.4.0-1.Final_redhat_00001.1.el9eap
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso, 18.0.6-1.redhat_00001.1.el9sso
Dell Data Protection Central - update to 19.11.0-2
IBM Business Automation Workflow - addressed in versions 21.0.3 IF020, 22.0.2 IF004
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.22, 22.0.2.6
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.2, 23.0.2
IBM Observability with Instana - update to 267
AMQ Clients - update to 2023.Q4

• Exploit #9379 - PyTorch Model Server Registration and Deserialization RCE (October 12, 2023)
• Exploit #9368 - SnakeYAML-CVE-2022-1471-POC (Code for veracode blog) (October 2, 2023)

• https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2
• https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in
• https://bugzilla.redhat.com/show_bug.cgi?id=2150009

• Remote code execution in SnakeYaml
• Red Hat Enterprise Linux 8 update for prometheus-jmx-exporter
• Multiple vulnerabilities in Red Hat build of Eclipse Vert.x
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Deserialization of untrusted data in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in OpenShift Container Platform 4.10
• Multiple vulnerabilities in Red Hat build of Quarkus
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in OpenShift Container Platform 4.9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat build of Quarkus
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.7
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.6
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
• Deserialization of untrusted data in IBM Maximo Data Loader
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in Axway SecureTransport
• Deserialization of untrusted data in IBM Spectrum Scale
• Multiple vulnerabilities in Oracle SD-WAN Edge
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Oracle Healthcare Translational Research
• Deserialization of untrusted data in IBM Business Automation Workflow
• Multiple vulnerabilities in Red Hat Satellite 6.13
• Deserialization of untrusted data in IBM Process Mining
• OpenShift Developer Tools and Services for OCP 4.11 update for jenkins and jenkins-2-plugins
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Operational Decision Manager
• Deserialization of untrusted data in IBM Planning Analytics Workspace
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Deserialization of untrusted data in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in Axway API Gateway and API Manager
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Deserialization of untrusted data in IBM Workload Scheduler
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Deserialization of untrusted data in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Deserialization of untrusted data in IBM Match 360
• Deserialization of untrusted data in IBM Db2 Graph
• Deserialization of untrusted data in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Deserialization of untrusted data in IBM UrbanCode Deploy (UCD)
• Deserialization of untrusted data in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in Oracle Communications Pricing Design Center
• Multiple vulnerabilities in Oracle Communications Network Charging and Control
• Multiple vulnerabilities in Oracle Communications Convergent Charging Controller
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in Oracle Hospitality Cruise Shipboard Property Management System
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in JD Edwards EnterpriseOne Orchestrator
• Multiple vulnerabilities in Oracle Siebel CRM
• Multiple vulnerabilities in Oracle Linux
• Deserialization of untrusted data in IBM Db2 Web Query for i
• Multiple vulnerabilities in IBM Watson Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat Openshift Application Runtimes
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in IBM Planning Analytics Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in PyTorch TorchServe
• Multiple vulnerabilities in IBM Spectrum Symphony
• Multiple vulnerabilities in Oracle Banking Party Management
• Deserialization of Untrusted Data in Oracle Banking Loans Servicing
• Multiple vulnerabilities in Oracle FLEXCUBE Core Banking
• Multiple vulnerabilities in Oracle Banking Deposits and Lines of Credit Servicing
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in Oracle Retail Xstore Point of Service
• Multiple vulnerabilities in IBM UrbanCode Build
• Red Hat Product OCP Tools 4.11 update for Openshift Jenkins
• IBM Data Replication on Cloud Pak for Data update for SnakeYaml
• Deserialization of untrusted data in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component
• Jira Software Data Center and Server update for SnakeYaml
• Automation for Jira update for SnakeYaml
• Bitbucket Data Center and Server update for SnakeYAML library
• Confluence Data Center and Server update for SnakeYAML library
• Jira Service Management Server and Data Center update for SnakeYAML library
• Automation for Jira - Server Lite update for SnakeYAML library
• Multiple vulnerabilities in Red Hat AMQ Clients
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Deserialization of untrusted data in IBM Cloud Pak System
• Multiple vulnerabilities in IBM Db2
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Security Verify Access
• Multiple vulnerabilities in Communications Service Catalog and Design
• Multiple vulnerabilities in IBM Disconnected Log Collector
• OpenShift Developer Tools and Services for OCP 4.11 update for jenkins and jenkins-2-plugins
• Multiple vulnerabilities in IBM Observability with Instana
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in Red Hat Process Automation Manager 7.13
• Multiple vulnerabilities in IBM WebSphere Service Registry and Repository
• Multiple vulnerabilities in Oracle SOA Suite
• Multiple vulnerabilities in IBM Integration Designer
• Multiple vulnerabilities in IBM Business Automation Manager Open Editions
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in Dell Data Protection Central
• Deserialization of untrusted data in IBM watsonx.data
• IBM watsonx.data update for FasterXML jackson-databind
• IBM Global High Availability Mailbox update for SnakeYaml
• Multiple vulnerabilities in Guardium Data Security Center
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7
• Anolis OS update for prometheus-jmx-exporter
• Multiple vulnerabilities in Dell PowerStore X
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Multiple vulnerabilities in Oracle Utilities Testing Accelerator
• Multiple vulnerabilities in Oracle Utilities Network Management System
• Multiple vulnerabilities in Oracle FLEXCUBE Investor Servicing
• Multiple vulnerabilities in Oracle Banking Digital Experience
• Multiple vulnerabilities in Oracle Banking APIs
• Multiple vulnerabilities in IBM DataStax Hyper-Converged Database
• Jira Software Data Center update for snakeyaml
• Confluence Data Center update for snakeyaml
• Jira Service Management Data Center update for snakeyaml
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition