Deserialization of Untrusted Data in Scala - CVE-2022-36944

Vulnerability identifier: #VU70531

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-36944

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data during Java object deserialization. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Scala
IBM Tivoli Netcool Impact
Oracle Financial Services Model Management and Governance
Oracle Communications Network Analytics Data Director
Netcool Operations Insight
IBM Cloud Pak for Multicloud Management Monitoring
Communications Service Catalog and Design
IBM Engineering Requirements Management DOORS Next
Oracle Communications Policy Management
Cloud Pak for Network Automation
Netezza Performance Server Replication Services
IBM Engineering Lifecycle Optimization - Publishing
Oracle Communications BRM - Elastic Charging Engine
Oracle Banking Corporate Lending Process Management
Fedora
AMQ Streams
scala

Install updates from vendor's website.

Scala - update to 2.13.9
IBM Tivoli Netcool Impact - update to 7.1.0.28
IBM Engineering Requirements Management DOORS Next - update to 9.7.2.8
Oracle Communications BRM - Elastic Charging Engine - update to 12.0.0.7.0
Netcool Operations Insight - update to 1.6.7
IBM Cloud Pak for Multicloud Management Monitoring - update to 2.3 Fix Pack 7
AMQ Streams - addressed in versions 2.4.0, 2.5.0
Cloud Pak for Network Automation - update to 2.4.3
scala - addressed in versions 2.13.9-1.fc35, 2.13.9-1.fc36
Netezza Performance Server Replication Services - update to 3.0.5.0
IBM Engineering Lifecycle Optimization - Publishing - addressed in versions 7.0.2.35, 7.0.3.16, 7.1.4 SR1

• Exploit #9128 - lazylist-cve-poc (POC for the CVE-2022-36944 vulnerability exploit) (June 22, 2023)

• https://github.com/scala/scala/pull/10118
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3WMKPFAMFQE3HJVRQ5KOJUTWG264SXI/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ZOZVWY3X72FZZCCRAKRJYTQOJ6LUD6Z/
• https://discuss.lightbend.com/t/impact-of-cve-2022-36944-on-akka-cluster-akka-actor-akka-remote/10007/2
• https://github.com/scala/scala-collection-compat/releases/tag/v2.9.0

• Deserialization of untrused data in Scala
• IBM Tivoli Netcool Impact update for Scala
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Red Hat AMQ Streams 2.4
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Deserialization of untrusted data in IBM Cloud Pak for Multicloud Management Monitoring
• Multiple vulnerabilities in Red Hat AMQ Streams
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in Oracle Communications Policy Management
• Multiple vulnerabilities in Communications Service Catalog and Design
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in IBM Engineering Requirements Management DOORS/DWA
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Fedora 35 update for scala
• Fedora 36 update for scala
• IBM Engineering Lifecycle Optimization - Publishing update for Scala
• Multiple vulnerabilities in IBM Netezza Performance Server Replication Services