Information disclosure in Mime4j - CVE-2022-45787

Vulnerability identifier: #VU70797

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-45787

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to improper laxist permissions on the temporary files. A local user can gain unauthorized access to sensitive information on the system.

Mime4j
Rational Performance Tester
DevOps Test Performance
IBM i Modernization Engine for Lifecycle Integration
PowerVM NovaLink
IBM Planning Analytics Workspace
IBM Sterling B2B Integrator
IBM Tivoli Netcool Impact
IBM TXSeries for Multiplatforms
Red Hat Integration - Service Registry
IBM Watson Discovery for IBM Cloud Pak for Data
Data Replication on Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Match 360
IBM Spectrum Control
IBM Cloud Application Performance Management (APM)
IBM Cloud Pak for Business Automation
IBM i
openEuler
JBoss Enterprise Application Platform
IBM WebSphere Application Server Liberty
Red Hat Single Sign-On
IBM CICS TX Advanced
IBM CICS TX Standard
Oracle Communications Cloud Native Core Console
eap7-jboss-el (Red Hat package)
apache-mime4j-javadoc
apache-mime4j
eap7-apache-mime4j (Red Hat package)
eap7-activemq-artemis-native (Red Hat package)
eap7-artemis-native (Red Hat package)
eap7-artemis-wildfly-integration (Red Hat package)
eap7-wildfly-http-client (Red Hat package)
eap7-ironjacamar (Red Hat package)
eap7-jboss-server-migration (Red Hat package)
eap7-snakeyaml (Red Hat package)
eap7-undertow-jastow (Red Hat package)
eap7-undertow (Red Hat package)
eap7-picketlink-federation (Red Hat package)
eap7-jbossws-spi (Red Hat package)
eap7-resteasy (Red Hat package)
eap7-jboss-ejb-client (Red Hat package)
eap7-netty-transport-native-epoll (Red Hat package)
eap7-netty (Red Hat package)
eap7-jbossws-cxf (Red Hat package)
eap7-wildfly (Red Hat package)
eap7-infinispan (Red Hat package)
eap7-jboss-metadata (Red Hat package)
rh-sso7-keycloak (Red Hat package)
Planning Analytics Local
Operational Decision Manager
IBM Cognos Analytics

Install updates from vendor's website.

Mime4j - update to 0.8.9
IBM Sterling B2B Integrator - addressed in versions 6.0.3.9, 6.1.0.8, 6.1.2.3, 6.2.0.0
IBM Tivoli Netcool Impact - update to 7.1.0.30
JBoss Enterprise Application Platform - update to 7.4.10
Red Hat Single Sign-On - update to 7.6.3
DevOps Test Performance - update to 11.0.7
eap7-jboss-el (Red Hat package) - addressed in versions api_3.0_spec-2.0.1-1.Final_redhat_00001.1.el7eap, api_3.0_spec-2.0.1-1.Final_redhat_00001.1.el8eap, api_3.0_spec-2.0.1-1.Final_redhat_00001.1.el9eap
apache-mime4j-javadoc - addressed in versions 0.8.1-3, 0.8.3-3, 0.8.7-5
apache-mime4j - addressed in versions 0.8.1-3, 0.8.3-3, 0.8.7-5
eap7-apache-mime4j (Red Hat package) - addressed in versions 0.8.9-1.redhat_00001.1.el7eap, 0.8.9-1.redhat_00001.1.el8eap, 0.8.9-1.redhat_00001.1.el9eap
eap7-activemq-artemis-native (Red Hat package) - addressed in versions 1.0.2-3.redhat_00004.1.el7eap, 1.0.2-3.redhat_00004.1.el8eap, 1.0.2-3.redhat_00004.1.el9eap
eap7-artemis-native (Red Hat package) - addressed in versions 1.0.2-4.redhat_00004.1.el7eap, 1.0.2-4.redhat_00004.1.el8eap, 1.0.2-4.redhat_00004.1.el9eap
eap7-artemis-wildfly-integration (Red Hat package) - addressed in versions 1.0.7-1.redhat_00001.1.el7eap, 1.0.7-1.redhat_00001.1.el8eap, 1.0.7-1.redhat_00001.1.el9eap
eap7-wildfly-http-client (Red Hat package) - addressed in versions 1.1.16-1.Final_redhat_00002.1.el7eap, 1.1.16-1.Final_redhat_00002.1.el8eap, 1.1.16-1.Final_redhat_00002.1.el9eap
IBM i Modernization Engine for Lifecycle Integration - update to 1.4.4
eap7-ironjacamar (Red Hat package) - addressed in versions 1.5.11-1.Final_redhat_00001.1.el7eap, 1.5.11-1.Final_redhat_00001.1.el8eap, 1.5.11-1.Final_redhat_00001.1.el9eap
eap7-jboss-server-migration (Red Hat package) - addressed in versions 1.10.0-26.Final_redhat_00025.1.el7eap, 1.10.0-26.Final_redhat_00025.1.el8eap, 1.10.0-26.Final_redhat_00025.1.el9eap
eap7-snakeyaml (Red Hat package) - addressed in versions 1.33.0-2.SP1_redhat_00001.1.el7eap, 1.33.0-2.SP1_redhat_00001.1.el8eap, 1.33.0-2.SP1_redhat_00001.1.el9eap
PowerVM NovaLink - addressed in versions 2.0.1-230412, 2.0.3.1.1-230413, 2.1.1-230424
Planning Analytics Local - update to 2.0.9.19
eap7-undertow-jastow (Red Hat package) - addressed in versions 2.0.14-1.Final_redhat_00001.1.el7eap, 2.0.14-1.Final_redhat_00001.1.el8eap, 2.0.14-1.Final_redhat_00001.1.el9eap
IBM Planning Analytics Workspace - update to 2.0.91
eap7-undertow (Red Hat package) - addressed in versions 2.2.23-1.SP2_redhat_00001.1.el7eap, 2.2.23-1.SP2_redhat_00001.1.el8eap, 2.2.23-1.SP2_redhat_00001.1.el9eap
Red Hat Integration - Service Registry - update to 2.4.3
eap7-picketlink-federation (Red Hat package) - addressed in versions 2.5.5-22.SP12_redhat_00012.1.el7eap, 2.5.5-22.SP12_redhat_00012.1.el8eap, 2.5.5-22.SP12_redhat_00012.1.el9eap
eap7-jbossws-spi (Red Hat package) - addressed in versions 3.4.0-2.Final_redhat_00001.1.el7eap, 3.4.0-2.Final_redhat_00001.1.el8eap, 3.4.0-2.Final_redhat_00001.1.el9eap
eap7-resteasy (Red Hat package) - addressed in versions 3.15.5-1.Final_redhat_00001.1.el7eap, 3.15.5-1.Final_redhat_00001.1.el8eap, 3.15.5-1.Final_redhat_00001.1.el9eap
eap7-jboss-ejb-client (Red Hat package) - addressed in versions 4.0.50-1.Final_redhat_00001.1.el7eap, 4.0.50-1.Final_redhat_00001.1.el8eap, 4.0.50-1.Final_redhat_00001.1.el9eap
eap7-netty-transport-native-epoll (Red Hat package) - addressed in versions 4.1.86-1.Final_redhat_00001.1.el7eap, 4.1.86-1.Final_redhat_00001.1.el8eap, 4.1.86-1.Final_redhat_00001.1.el9eap
eap7-netty (Red Hat package) - addressed in versions 4.1.86-1.Final_redhat_00001.1.el7eap, 4.1.86-1.Final_redhat_00001.1.el8eap, 4.1.86-1.Final_redhat_00001.1.el9eap
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
Data Replication on Cloud Pak for Data - update to 4.6.5
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7
IBM Match 360 - update to 4.7.0
eap7-jbossws-cxf (Red Hat package) - addressed in versions 5.4.8-1.Final_redhat_00001.1.el7eap, 5.4.8-1.Final_redhat_00001.1.el8eap, 5.4.8-1.Final_redhat_00001.1.el9eap
IBM Spectrum Control - update to 5.4.10.2
eap7-wildfly (Red Hat package) - addressed in versions 7.4.10-6.GA_redhat_00002.1.el7eap, 7.4.10-6.GA_redhat_00002.1.el8eap, 7.4.10-6.GA_redhat_00002.1.el9eap
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.14
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 53, 8.11.0.1 Interim fix 28, 8.11.1 Interim fix 20, 8.12.0.1 Interim fix 2
eap7-infinispan (Red Hat package) - addressed in versions 11.0.17-1.Final_redhat_00001.1.el7eap, 11.0.17-1.Final_redhat_00001.1.el8eap, 11.0.17-1.Final_redhat_00001.1.el9eap
IBM Cognos Analytics - addressed in versions 11.2.4 Fix Pack 2, 12.0.1
eap7-jboss-metadata (Red Hat package) - addressed in versions 13.4.0-1.Final_redhat_00001.1.el7eap, 13.4.0-1.Final_redhat_00001.1.el8eap, 13.4.0-1.Final_redhat_00001.1.el9eap
rh-sso7-keycloak (Red Hat package) - addressed in versions 18.0.7-1.redhat_00001.1.el7sso, 18.0.7-1.redhat_00001.1.el8sso, 18.0.7-1.redhat_00001.1.el9sso
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.21, 22.0.2.5

• https://lists.apache.org/thread/26s8p9stl1z261c4qw15bsq03tt7t0rj

• Information disclosure in Apache James MIME4J
• IBM WebSphere Application Server Liberty update for Apache James
• IBM CICS TX Advanced update for Apache James
• IBM CICS TX Standard update for Apache James
• IBM TXSeries for Multiplatforms update for Apache James
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 9
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 8
• Multiple vulnerabilities in Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7
• Multiple vulnerabilities in IBM i
• Information disclosure in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 9
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 8
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for RHEL 7
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6 for OpenShift
• Information disclosure in IBM PowerVM Novalink
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in Red Hat Integration - Service Registry
• Information disclosure in IBM Tivoli Netcool Impact
• Information disclosure in IBM Match 360
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in IBM Watson Knowledge Catalog for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Multiple vulnerabilities in IBM Cognos Analytics
• Multiple vulnerabilities in IBM Spectrum Control
• IBM Data Replication on Cloud Pak for Data update for Apache James
• Multiple vulnerabilities in IBM Planning Analytics
• Information disclosure in IBM Sterling B2B Integrator
• Multiple vulnerabilities in IBM Operational Decision Manager
• openEuler 20.03 LTS SP4 update for apache-mime4j
• openEuler 24.03 LTS SP1 update for apache-mime4j
• openEuler 24.03 LTS update for apache-mime4j
• openEuler 22.03 LTS SP4 update for apache-mime4j
• openEuler 22.03 LTS SP3 update for apache-mime4j
• openEuler 24.03 LTS SP2 update for apache-mime4j
• IBM Rational Performance Tester update for MIME4J library