NW-2023-06: Multiple components within NetWitness Platform XDR require a security update to address various vulnerabilities

Tags: Advisories, Security Advisories

Advisory Type

Security

Advisory Content

NetWitness Identifier

NW-2023-06

CVE Identifier

CVE-2022-39135, CVE-2020-26137, CVE-2021-33503, CVE-2019-11324, CVE-2018-20060, CVE-2023-20873, CVE-2023-20862, CVE-2022-36944, CVE-2022-22965, CVE-2022-34169, CVE-2022-22980, CVE-2019-11236, CVE-2023-1393, CVE-2023-21930, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939, CVE-2023-21954, CVE-2023-21967, CVE-2023-21968, CVE-2022-36364, CVE-2023-1370, CVE-2022-45143, CVE-2022-42252, CVE-2021-46877, CVE-2022-42004, CVE-2022-42003, CVE-2020-36518, CVE-2022-23437, CVE-2012-0881, CVE-2013-4002, CVE-2009-2625, CVE-2023-25194, CVE-2023-24998, CVE-2022-41966, CVE-2022-40152, CVE-2022-40151, CVE-2019-10172, CVE-2022-25647, CVE-2022-3171, CVE-2016-5017, CVE-2020-10663, CVE-2022-29885, CVE-2018-1320, CVE-2020-13949, CVE-2019-0205, CVE-2019-0231, CVE-2015-3250, CVE-2021-35517, CVE-2021-36090, CVE-2021-35515, CVE-2021-40829, CVE-2021-40828, CVE-2021-40830, CVE-2022-41881, CVE-2022-41915, CVE-2022-25647, CVE-2022-22978, CVE-2022-38023, CVE-2023-0767, CVE-2023-0286, CVE-2023-0494, CVE-2022-37434, CVE-2022-42703, CVE-2022-4378, CVE-2023-28708, CVE-2021-22569, CVE-2018-1288, CVE-2022-22976

Severity

Medium

Severity Rating

CVSS v3 Base Score: See NVD (http://nvd.nist.gov/) for individual scores for each CVE

Affected Products

NetWitness Platform versions prior to 12.3.

Summary

Multiple components within NetWitness Platform require a security update to address various vulnerabilities.

Details

The embedded components are updated for the following vulnerabilities:

CentOS: CVE-2022-38023

https://access.redhat.com/errata/RHSA-2023:1090

CentOS: CVE-2023-1393

https://access.redhat.com/errata/RHSA-2023:1594

CentOS: CVE-2023-21930, CVE-2023-21937, CVE-2023-21938, CVE-2023-21939, CVE-2023-21954, CVE-2023-21967, CVE-2023-21968

https://access.redhat.com/errata/RHSA-2023:1878

CentOS: CVE-2023-0767

https://access.redhat.com/errata/RHSA-2023:1332

CentOS: CVE-2023-0286

https://access.redhat.com/errata/RHSA-2023:1335

CentOS: CVE-2023-0494

https://access.redhat.com/errata/RHSA-2023:0675

CentOS: CVE-2022-37434

https://access.redhat.com/errata/RHSA-2023:1095

Kernel: CVE-2022-4378, CVE-2022-42703

https://access.redhat.com/errata/RHSA-2023:1091

Kernel: CVE-2022-4378

https://access.redhat.com/errata/RHSA-2023:1101

CentOS: CVE-2022-38023

https://access.redhat.com/errata/RHSA-2023:1090

Black Duck: CVE-2022-36364

https://nvd.nist.gov/vuln/detail/CVE-2022-36364

Black Duck: CVE-2022-39135

https://nvd.nist.gov/vuln/detail/CVE-2022-39135

Black Duck: CVE-2022-33503

https://nvd.nist.gov/vuln/detail/CVE-2022-33503

Black Duck: CVE-2020-26137

https://nvd.nist.gov/vuln/detail/CVE-2020-26137

Black Duck: CVE-2019-11324

https://nvd.nist.gov/vuln/detail/CVE-2019-11324

Black Duck: CVE-2019-11236

https://nvd.nist.gov/vuln/detail/CVE-2019-11236

Black Duck: CVE-2018-20060

https://nvd.nist.gov/vuln/detail/CVE-2018-20060

Black Duck: CVE-2023-20873

https://nvd.nist.gov/vuln/detail/CVE-2023-20873

Black Duck: CVE-2023-20862

https://nvd.nist.gov/vuln/detail/CVE-2023-20862

Black Duck: CVE-2023-1370

https://nvd.nist.gov/vuln/detail/CVE-2023-1370

Black Duck: CVE-2023-28708

https://nvd.nist.gov/vuln/detail/CVE-2023-28708

Black Duck: CVE-2022-45143

https://nvd.nist.gov/vuln/detail/CVE-2022-45143

Black Duck: CVE-2022-42252

https://nvd.nist.gov/vuln/detail/CVE-2022-42252

Black Duck: CVE-2021-46877

https://nvd.nist.gov/vuln/detail/CVE-2021-46877

Black Duck: CVE-2022-42004

https://nvd.nist.gov/vuln/detail/CVE-2022-42004

Black Duck: CVE-2022-42003

https://nvd.nist.gov/vuln/detail/CVE-2022-42003

Black Duck: CVE-2020-36518

https://nvd.nist.gov/vuln/detail/CVE-2020-36518

Black Duck: CVE-2022-23437

https://nvd.nist.gov/vuln/detail/CVE-2022-23437

Black Duck: CVE-2012-0881

https://nvd.nist.gov/vuln/detail/CVE-2012-0881

Black Duck: CVE-2013-4002

https://nvd.nist.gov/vuln/detail/CVE-2013-4002

Black Duck: CVE-2009-2625

https://nvd.nist.gov/vuln/detail/CVE-2009-2625

Black Duck: CVE-2023-25194

https://nvd.nist.gov/vuln/detail/CVE-2023-25194

Black Duck: CVE-2022-36944

https://nvd.nist.gov/vuln/detail/CVE-2022-36944

Black Duck: CVE-2022-22965

https://nvd.nist.gov/vuln/detail/CVE-2022-22965

Black Duck: CVE-2023-24998

https://nvd.nist.gov/vuln/detail/CVE-2023-24998

Black Duck: CVE-2022-41966

https://nvd.nist.gov/vuln/detail/CVE-2022-41966

Black Duck: CVE-2022-40152

https://nvd.nist.gov/vuln/detail/CVE-2022-40152

Black Duck: CVE-2022-40151

https://nvd.nist.gov/vuln/detail/CVE-2022-40151

Black Duck: CVE-2021-22569

https://nvd.nist.gov/vuln/detail/CVE-2021-22569

Black Duck: CVE-2019-10172

https://nvd.nist.gov/vuln/detail/CVE-2019-10172

Black Duck: CVE-2022-25647

https://nvd.nist.gov/vuln/detail/CVE-2022-25647

Black Duck: CVE-2022-3171

https://nvd.nist.gov/vuln/detail/CVE-2022-3171

Black Duck: CVE-2016-5017

https://nvd.nist.gov/vuln/detail/CVE-2016-5017

Black Duck: CVE-2020-10663

https://nvd.nist.gov/vuln/detail/CVE-2020-10663

Black Duck: CVE-2022-29885

https://nvd.nist.gov/vuln/detail/CVE-2022-29885

Black Duck: CVE-2018-1320

https://nvd.nist.gov/vuln/detail/CVE-2018-1320

Black Duck: CVE-2020-13949

https://nvd.nist.gov/vuln/detail/CVE-2020-13949

Black Duck: CVE-2019-0205

https://nvd.nist.gov/vuln/detail/CVE-2019-0205

Black Duck: CVE-2019-0231

https://nvd.nist.gov/vuln/detail/CVE-2019-0231

Black Duck: CVE-2018-1288

https://nvd.nist.gov/vuln/detail/CVE-2018-1288

Black Duck: CVE-2015-3250

https://nvd.nist.gov/vuln/detail/CVE-2015-3250

Black Duck: CVE-2021-35517

https://nvd.nist.gov/vuln/detail/CVE-2021-35517

Black Duck: CVE-2021-36090

https://nvd.nist.gov/vuln/detail/CVE-2021-36090

Black Duck: CVE-2021-35515

https://nvd.nist.gov/vuln/detail/CVE-2021-35515

Black Duck: CVE-2021-40829

https://nvd.nist.gov/vuln/detail/CVE-2021-40829

Black Duck: CVE-2021-40828

https://nvd.nist.gov/vuln/detail/CVE-2021-40828

Black Duck: CVE-2021-40830

https://nvd.nist.gov/vuln/detail/CVE-2021-40830

Black Duck: CVE-2022-41881

https://nvd.nist.gov/vuln/detail/CVE-2022-41881

Black Duck: CVE-2022-41915

https://nvd.nist.gov/vuln/detail/CVE-2022-41915

Black Duck: CVE-2022-22976

https://nvd.nist.gov/vuln/detail/CVE-2022-22976

Black Duck: CVE-2022-22978

https://nvd.nist.gov/vuln/detail/CVE-2022-22978

Black Duck: CVE-2022-34169

https://nvd.nist.gov/vuln/detail/CVE-2022-34169

Black Duck: CVE-2022-22980

https://nvd.nist.gov/vuln/detail/CVE-2022-22980

For more information about any of the Common Vulnerabilities and Exposures (CVEs) mentioned here, consult the National Vulnerability Database (NVD) at https://nvd.nist.gov/home# . To search for a particular CVE, use the database’s search utility at https://nvd.nist.gov/search

Recommendation

The following NetWitness Platform release contains resolutions to these vulnerabilities: NetWitness Platform version 12.3

NetWitness recommends all customers upgrade at the earliest opportunity.

For additional documentation, downloads and more, visit the NetWitness Platform page on NetWitness Community.

Severity Rating

For an explanation of Severity Ratings, refer to the Vulnerability Disclosure Policy. NetWitness recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.

EOPS Policy

NetWitness has a defined End of Primary Support policy associated with all major versions. Please refer to the Product Version Life Cycle for additional details.

Legal Information

Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this advisory, contact NetWitness Customer Support. RSA Security LLC and its affiliates distribute RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information.

RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement.

In no event shall RSA, its affiliates or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or its suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.