CVE-2022-43867 IBM Spectrum Scale command execution

What is CVE-2022-43867?

CVE-2022-43867 is a high-severity command injection vulnerability in IBM Spectrum Scale, published on 6 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM Spectrum Scale 5.1.0.1 through 5.1.4.1 could allow a local attacker to execute arbitrary commands in the container. IBM X-Force ID: 239437.

Weakness: CWE-78

Which versions are affected by CVE-2022-43867?

It affects 1 product.

Products include Ibm Spectrum Scale Container Native Storage Access.

How do I fix CVE-2022-43867?

No fix has been published for CVE-2022-43867 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-43867 being exploited?

There is no known exploitation of CVE-2022-43867 in the wild and no public exploit code.

Other vulnerabilities in IBM Spectrum Scale

• CVE-2022-41736 IBM Spectrum Scale Container Native Storage Access privilege escalation High 8.4
• CVE-2022-41739 IBM Spectrum Scale privilege escalation High 7.9
• CVE-2022-41738 IBM Spectrum Scale security bypass High 7.5
• CVE-2022-43831 IBM Spectrum Scale privilege escalation High 7.4
• CVE-2022-41737 IBM Spectrum Scale security bypass High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p988-8hhv-9wpv.