ValueEdge: Value Stream Management
Align corporate investments with business strategy
Continuous quality from requirements to delivery
Scale enterprise SCCM with security and compliance
Resilient AI-powered functional test automation
Enterprise-level requirements management
Deliver continuous application performance testing
Plan, track, orchestrate, and release applications
Govern quality and implement auditable processes
Automate deployments for continuous delivery
Build business applications using new tools & platforms
The leading solution for COBOL application modernization
Modernize mainframe applications for the Cloud
Modernize host application access
Discover the future of CORBA
Modern mainframe application delivery for IBM Z
Secure, zero-footprint access to host applications
Access host data and automate processes with RPA
Multi-factor Authentication for IBM z/OS endpoints
Build secure software fast
Augment human intelligence
Discover, analyze, and protect sensitive data
Drive IT ecosystem with identity-centric expertise
Deliver simplified, secure access to users
Scale to billions of identities with IGA platform
Gain control of privileged user activities
Track changes and activities in managed services
Get fast, accurate detection of threats
Analytics for text, audio, video, and image data
Reduce risk, cost, and maintenance, and T2M
AI and machine learning for data analysis
Enterprise backup/disaster recovery
Unified traditional and mobile device management
Meet regulatory & privacy retention requirements
Email, IM, and chat-based collaboration
Mobile workforce communication & collaboration
Secure critical file storage and print services
Manage IT & non-IT services with automation and AI
Discover, monitor, and remediate with AIOps
Monitor and optimize complex networks
Discover, manage, and map configurations & assets
Accelerate provisioning with governance in place
Automate and orchestrate processes end to end
Manage IT & software assets for better compliance
Automate server provisioning, patching, and compliance
Automate screen-based human actions with robots
All Micro Focus learning in one place
Build the skills to succeed
Streamline software delivery for faster value
ValueEdge: Value Stream Management
Align corporate investments with business strategy
Continuous quality from requirements to delivery
Scale enterprise SCCM with security and compliance
Resilient AI-powered functional test automation
Enterprise-level requirements management
Deliver continuous application performance testing
Plan, track, orchestrate, and release applications
Govern quality and implement auditable processes
Automate deployments for continuous delivery
Access all products in application delivery management
Modernize Core Business Systems to Drive Business Transformation
Build business applications using new tools & platforms
The leading solution for COBOL application modernization
Modernize mainframe applications for the Cloud
Modernize host application access
Discover the future of CORBA
Modern mainframe application delivery for IBM Z
Secure, zero-footprint access to host applications
Access host data and automate processes with RPA
Multi-factor Authentication for IBM z/OS endpoints
Access all products in Application Modernization & Connectivity
Security at the core to everything you do; Operations, Applications, Identity and Data
Build secure software fast
Augment human intelligence
Discover, analyze, and protect sensitive data
Drive IT ecosystem with identity-centric expertise
Deliver simplified, secure access to users
Scale to billions of identities with IGA platform
Gain control of privileged user activities
Track changes and activities in managed services
Get fast, accurate detection of threats
Access all products in CyberRes
Trusted, proven legal, compliance and privacy solutions
Analytics for text, audio, video, and image data
Reduce risk, cost, and maintenance, and T2M
AI and machine learning for data analysis
Enterprise backup/disaster recovery
Unified traditional and mobile device management
Meet regulatory & privacy retention requirements
Email, IM, and chat-based collaboration
Mobile workforce communication & collaboration
Secure critical file storage and print services
Access all products in Information Management and Governance
Simplify Your IT Transformation
Manage IT & non-IT services with automation and AI
Discover, monitor, and remediate with AIOps
Monitor and optimize complex networks
Discover, manage, and map configurations & assets
Accelerate provisioning with governance in place
Automate and orchestrate processes end to end
Manage IT & software assets for better compliance
Automate server provisioning, patching, and compliance
Automate screen-based human actions with robots
Access all products in IT Operations Management
Give your team the power to make your business perform to its fullest
CVE Description: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Yes, and we have a robust, dedicated, full-time threat intelligence team with a Micro Focus-wide view, that is constantly reviewing new reports of vulnerabilities, threats, and compromises for possible impact to our information assets.
Micro Focus implements a Secure Development Lifecycle that includes Supply Chain Security, 3rd Party Component Manifest and 3rd Party Component Monitoring. Using these formal practices, we help ensure that 3rd party components are sourced from trusted repositories, scanned and tested, free of known CVEs, and signed to ensure authenticity. New vulnerabilities are scanned and tracked to ensure closure. Additionally, Micro Focus has scheduled rolling scans using a variety of tools to detect a wide variety of vulnerabilities. Vendor rule sets/signatures and code are typically scrutinized after a new vulnerability announcement. We continue to get updates from our security vendors and internal security community on the latest scanning techniques for CVE-2022-22965 and other vulnerabilities. We also take a risk-based approach to prioritizing which patches get applied first.
We are prioritizing CVE-2022-22965 alongside other patch efforts. We rank potential patches according to CVSS scoring, and also our own enhanced scoring system that takes additional data points into account. Configuration changes or patch installations require Quality Assurance analysis and testing prior to deployment to production systems to prevent unexpected service interruptions.
At present, we are not aware of any current indications of compromise related to CVE-2022-22965 or related vulnerabilities.
At present, we are not aware of any improper access or disclosure of customer data related to CVE-2022-22965 or any related vulnerabilities.
April 4, 2022
Micro Focus continues to monitor CVE-2022-22965 vulnerability closely and issues appropriate patches, security bulletins and communications to support our customers. As this is a still evolving situation we will monitor and actively address changes. Keep watching the Micro Focus Security Bulletins for any changes resulting from further industry analysis of this vulnerability. Micro Focus is committed to continue to provide prompt remediation if the situation develops further. We will periodically update this page to ensure you have the latest information on our status.
If you don’t see your product listed, please come back for updates. Please contact support if urgent.