VSALGADO VARA181359 (Community Member) asked a question.
Could someone help me with this vulnerability CVE-2022-22356
Could someone help me with this vulnerability CVE-2022-22356, it's tell me that this dependency is vulnerable IBM MQ 9.2.5.0 by Access-Control Bypass, but it's the last version of this library. Does anyone know how to fix it or know another compatible?
.png){kind=logo}
Hi @VSALGADO VARA181359 (Community Member),
Looking through Maven Repository, it seems to me that this is the library in question: https://mvnrepository.com/artifact/com.ibm.mq/com.ibm.mq.allclient. At this point, it looks like there is no patch available for this within Maven just yet.
In the meantime, IBM has published a Security Bulleting (https://www.ibm.com/support/pages/security-bulletin-ibm-datapower-gateway-vulnerable-temporary-dos) with more information which I would recommend referring to.
Thank you,
Florian Walter