Bug 2070668 (CVE-2022-22963)

Summary:	CVE-2022-22963 spring-cloud-function: Remote code execution by malicious Spring Expression
Product:	[Other] Security Response	Reporter:	Chess Hazlett <chazlett>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	fhirtz, jwon, krathod, lball, matzew, mthoemme, nsanborn, pescorza, rhuss, rrajasek, tmielke, ymittal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	spring-cloud-function 3.1.7, spring-cloud-function 3.2.3	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Spring Cloud Function via the spring.cloud.function.routing-expression header that is modified by the attacker to contain malicious expression language code. The attacker is able to call functions that should not normally be accessible, including runtime exec calls.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-04-08 19:30:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2070632

Description Chess Hazlett 2022-03-31 16:02:15 UTC

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Comment 5 Product Security DevOps Team 2022-04-08 19:30:03 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-22963

Comment 6 errata-xmlrpc 2022-04-11 08:22:34 UTC

This issue has been addressed in the following products:

  Openshift Serverless 1 on RHEL 8

Via RHSA-2022:1291 https://access.redhat.com/errata/RHSA-2022:1291

Comment 7 errata-xmlrpc 2022-04-11 10:57:32 UTC

This issue has been addressed in the following products:

  Openshift Serveless 1.21

Via RHSA-2022:1292 https://access.redhat.com/errata/RHSA-2022:1292