Bug 1213934 (CVE-2022-40609)

Summary:	VUL-0: CVE-2022-40609: java-1_8_0-ibm, java-1_7_1-ibm: unsafe deserialization flaw in the Object Request Broker (ORB)
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Alexander Bergmann <abergmann>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	fstrba, gianluca.gabrielli, meissner, pmonrealgonzalez, rfrohl, security-team, stoyan.manolov
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/373880/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Alexander Bergmann 2023-08-03 12:02:57 UTC

CVE-2022-40609

IBM SDK, Java Technology Edition 7.1.5.18 and 8.0.8.0 could allow a remote
attacker to execute arbitrary code on the system, caused by an unsafe
deserialization flaw. By sending specially-crafted data, an attacker could
exploit this vulnerability to execute arbitrary code on the system.  IBM X-Force
ID:  236069.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-40609
https://bugzilla.redhat.com/show_bug.cgi?id=2228078
https://www.cve.org/CVERecord?id=CVE-2022-40609
https://exchange.xforce.ibmcloud.com/vulnerabilities/236069
http://www.ibm.com/support/pages/node/7017032
https://access.redhat.com/errata/RHSA-2023:4103.html
https://access.redhat.com/errata/RHSA-2023:4160.html

Comment 2 Maintenance Automation 2023-08-28 08:30:04 UTC

SUSE-SU-2023:3441-1: An update that solves eight vulnerabilities and has two fixes can now be installed.

Category: security (important)
Bug References: 1207922, 1213473, 1213474, 1213475, 1213479, 1213481, 1213482, 1213541, 1213934, 1214431
CVE References: CVE-2022-40609, CVE-2023-22006, CVE-2023-22036, CVE-2023-22041, CVE-2023-22044, CVE-2023-22045, CVE-2023-22049, CVE-2023-25193
Sources used:

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 10 Fridrich Strba 2024-03-05 08:51:25 UTC

This is now fixed.

Comment 11 Robert Frohl 2024-05-23 07:48:15 UTC

done, closing