Security at TIBCO

Security@TIBCO

TIBCO takes its security responsibilities very seriously. This page provides information about TIBCO security and how customers or security researchers can contact TIBCO to report or ask about a security issue.

Report an Issue
Contact Us
Security at TIBCO

Public Notice

Spring Framework Vulnerability Update

07 April 2022

TIBCO is aware of the recently announced Java Spring Framework vulnerabilities (CVE-2022-22963, CVE-2022-22965), with one of them being referred to as “Spring4Shell”. These vulnerabilities potentially enable an attacker to execute arbitrary code by taking advantage of poor data bindings and/or malicious expression language statements. 

TIBCO is also aware of CVE-2022-22950, and this issue is under investigation as part of our response to CVE-2022-22963 and CVE-2022-22965. 

TIBCO is actively monitoring the still evolving situation and updates with regards to the Java Spring Framework and our Product Security Incident Response Team (PSIRT) is actively evaluating how this vulnerability may affect TIBCO products and cloud services. 

We will provide updates as more information becomes available and we complete our investigation. This information will include which TIBCO products and services are affected and how customers and users of those products and services can best mitigate or protect themselves from being exploited by this vulnerability.

For more information on the vulnerability, please see the following references:



 

Spring Framework Status for TIBCO Products

(applies to versions that are currently in Standard Support)

New Products or status change not in previous updates are indicated by the product name in BOLD

Short Term Mitigations and Service Packs are hotlinked in the product name.

Legend

✅ - Unaffected

🛠️ - Remediated through Service Pack or Short Term Mitigation

🔍 - Under Investigation

 

TIBCO Product

CVE-2022-22950

CVE-2022-22963

CVE-2022-22965

TIBCO® distribution of Apache Kafka - All Versions

✅

✅

✅

TIBCO® distribution of Apache Pulsar - All Versions

✅

✅

✅

TIBCO ActiveMatrix® Adapter for Files for Unix/Win - All Versions

✅

✅

✅

TIBCO ActiveMatrix® Adapter for Files for Unix/Win - All Versions

✅

✅

✅

TIBCO ActiveMatrix® Adapter for JD Edwards EnterpriseOne - All Versions

✅

✅

✅

TIBCO ActiveMatrix® Adapter for LDAP - All Versions

✅

✅

✅

TIBCO ActiveMatrix® Adapter for OSIsoft PI - All Versions

✅

✅

✅

TIBCO ActiveMatrix® Adapter for PeopleSoft - All Versions

✅

✅

✅

TIBCO ActiveMatrix® Adapter for Siebel - All Versions

✅

✅

✅

TIBCO ActiveMatrix® Adapter for WebSphere MQ - All Versions

✅

✅

✅

TIBCO ActiveMatrix® Adapter Framework - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ version 6.8.0 and below

🔍

✅

🔍 

TIBCO ActiveMatrix BusinessWorks™ ActiveAspects Plug-in - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Concur Solutions - Community Edition - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Database - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for EJB - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Facebook - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Files for Unix and Windows - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Google BigQuery - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Google Cloud Storage - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for HL7 with FHIR - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for JD Edwards EnterpriseOne - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for LDAP - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Microsoft Excel - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for OData Services for SAP S/4HANA - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Oracle E-Business Suite - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Oracle Tuxedo - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for OSIsoft PI System - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for PDF - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for PeopleSoft - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for SAP Ariba - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for SAP HANA Database - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for SAP Solutions - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for SAP SuccessFactors - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for sFTP - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Siebel - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for SmartMapper - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Snowflake - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for SWIFT - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Trillium - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Twitter - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ Plug-in for Zendesk - Community Edition - All Versions

✅

✅

✅

TIBCO ActiveMatrix BusinessWorks™ SmartMapper Enterprise Server - All Versions

✅

✅

✅

TIBCO ActiveMatrix® Service Grid Platform version 3.4.0 and below

✅

✅

✅

TIBCO ActiveSpaces® - All Versions

✅

✅

✅

TIBCO® Adapter Migration - All Versions

✅

✅

✅

TIBCO® Adapter SDK - All Versions

✅

✅

✅

TIBCO Administrator version 5.12.0 and below

🔍

✅

🔍 

TIBCO® API Exchange Gateway - All Versions

✅

✅

✅

TIBCO® AuditSafe version 1.2 and below

🔍

✅

🔍 

TIBCO® BPM Enterprise version 5.2.2 and below

🔍

✅

🔍 

TIBCO BusinessConnect™ and its plugins version 7.3 and below

✅

✅

✅

TIBCO BusinessConnect™ Container Edition version 1.2 and below

🔍

✅

🔍 

TIBCO BusinessEvents® version 6.2.1 and below

🔍

✅

🔍 

TIBCO BusinessWorks™ Container Edition version 2.7.1 and below

✅

✅

✅

TIBCO BusinessWorks™ version 5.15.0 and below

🔍

✅

🔍 

TIBCO BusinessWorks™ 5 WASP plugins - All Versions

✅

✅

✅

TIBCO BusinessWorks™ 6 WASP plugins - All Versions

✅

✅

✅

TIBCO Cloud 

✅

✅

✅

    TIBCO Cloud™ Compute

✅

✅

✅

    TIBCO Cloud™ Data Streams

✅

✅

✅

    TIBCO Cloud™ Events

✅

✅

✅

    TIBCO Cloud™ Integration - Connect (Scribe)

✅

✅

✅

    TIBCO Cloud™ Integration - Develop (Flogo) 

✅

✅

✅

    TIBCO Cloud™ Messaging

✅

✅

✅

    TIBCO Cloud™ Spotfire

✅

✅

✅

    TIBCO Cloud™ Live Apps

🔍

✅

🔍 

    TIBCO Cloud™ Nimbus®

✅

✅

✅

TIBCO Cloud™ API Management - Local Edition version 5.5.1 and below

✅

✅

✅

TIBCO Cloud™ API Management - SaaS Edition - All Versions

✅

✅

✅

TIBCO DataSynapse GridServer® - All Versions

✅

✅

✅

TIBCO DataSynapse™ High-Performance Computing Cloud Adapter - All Versions

✅

✅

✅

TIBCO® Data Science version 1.2.1 and below

🔍

✅

🔍 

TIBCO® Data Science for TIBCO Spotfire® Analyst 14.0.0 and below

✅

✅

✅

TIBCO® Data Science Service for TIBCO Spotfire® 14.0.1 and below

🔍

✅

🔍 

TIBCO® Data Science Team Studio version 6.6 and below

🔍

✅

🔍 

TIBCO® Data Virtualization version 8.5.2 and below

✅

✅

✅

TIBCO EBX® version 6.0.5 and below

✅

✅

✅

TIBCO EBX® Addons  version 5.3.1 and below

🔍

✅

🔍 

TIBCO® Enterprise Administrator version 2.4.1 and below

🔍

✅

🔍 

TIBCO Enterprise Message Service™ - All Versions

✅

✅

✅

TIBCO Flogo® Connector for Amazon Elastic File System - All Versions

✅

✅

✅

TIBCO Flogo® Connector for Amazon Glacier - All Versions

✅

✅

✅

TIBCO Flogo® Connector for GitHub - All Versions

✅

✅

✅

TIBCO Flogo® Connector for Google Cloud SQL - All Versions

✅

✅

✅

TIBCO Flogo® Connector for Google Cloud Storage - All Versions

✅

✅

✅

TIBCO Flogo® Connector for Jira - All Versions

✅

✅

✅

TIBCO Flogo® Connector for Oracle Database - All Versions

✅

✅

✅

TIBCO Flogo® Connector for SAP Cloud for Customer - All Versions

✅

✅

✅

TIBCO Flogo® Connector for SAP HANA Database - All Versions

✅

✅

✅

TIBCO Flogo® Connector for SAP S/4HANA Cloud - All Versions

✅

✅

✅

TIBCO Flogo® Connector for SAP SuccessFactors - All Versions

✅

✅

✅

TIBCO Flogo® Connector for Snowflake - All Versions

✅

✅

✅

TIBCO Foresight® Archive and Retrieval System - All Versions

✅

✅

✅

TIBCO Foresight® Connect with FHIR - All Versions

✅

✅

✅

TIBCO Foresight® EDISIM - All Versions

✅

✅

✅

TIBCO Foresight® EDISIM HIPAA Validator Desktop - All Versions

✅

✅

✅

TIBCO Foresight® Operational Monitor - All Versions

✅

✅

✅

TIBCO Foresight® Transaction Insight® - All Versions

✅

✅

✅

TIBCO Foresight® Translator Attachment Adapter - All Versions

✅

✅

✅

TIBCO Foresight® Translator - Healthcare and Standard Editions - All Versions

✅

✅

✅

TIBCO eFTL™ - All Versions

✅

✅

✅

TIBCO FTL® - All Versions

✅

✅

✅

TIBCO® Fulfillment Subscriber Inventory version 2.0 and below

🔍

✅

🔍 

TIBCO® Graph Database version 3.1.0 and below

✅

✅

✅

TIBCO Hawk® version 6.2.0 and above

🔍

✅

🔍 

TIBCO® Inform Cloud version 8.5.0 and below

🔍

✅

🔍 

TIBCO iWay® Service Manager version 8.0.5 and above

✅

✅

✅

TIBCO JasperReports® IO (Professional and At-Scale offerings) version 3.0.x and below

🛠️

✅

🛠️ 

TIBCO JasperReports® Library (Professional and Community offerings)

 version 8.0.x and below

🛠️

✅

🛠️ 

TIBCO JasperReports® Server (Professional and Community offerings) version 8.0.x and below

🛠️

✅

🛠️ 

TIBCO JasperReports® Server for AWS version 8.0.x and below

🛠️

✅

🛠️ 

TIBCO JasperReports® Server for Azure version 8.0.x and below

🛠️

✅

🛠️ 

TIBCO Jaspersoft® Studio (Professional and Community offerings) version 8.0.x and below

🛠️

✅

🛠️ 

TIBCO LogLogic® Enterprise Virtual Appliance version 6.2.0 and above

🔍

✅

🔍 

TIBCO LogLogic® Log Management Intelligence version 6.2.0 and above

🔍

✅

🔍 

TIBCO LogLogic® Log Source Packages - All Versions

✅

✅

✅

TIBCO® Managed File Transfer Command Center version 8.4 and below

🛠️

✅

🛠️ 

TIBCO® Managed File Transfer Internet Server version 8.4 and below

🛠️

✅

🛠️ 

TIBCO® Managed File Transfer Platform Server for UNIX/zLinux - All Versions

✅

✅

✅

TIBCO® Managed File Transfer Platform Server for Windows - All Versions

✅

✅

✅

TIBCO® Managed File Transfer Platform Server for z/OS - All Versions

✅

✅

✅

TIBCO® MDM version 9.3.0 and below

🔍

✅

🔍 

TIBCO® Messaging - Eclipse Mosquitto Distribution - All Versions

✅

✅

✅

TIBCO® Messaging Manager - All Versions

✅

✅

✅

TIBCO® Messaging Monitor - All Versions

✅

✅

✅

TIBCO® Metadata Agent version 3.0.3 and below

🔍

✅

🔍 

TIBCO® ModelOps version 1.1 and below

🔍

✅

🔍 

TIBCO Nimbus® version 10.5.0 and below

✅

✅

✅

TIBCO Nimbus® Service version 10.5.0 and below

✅

✅

✅

TIBCO® Offer and Price Engine version 5.1.0 and below

🔍

🔍 

🔍 

TIBCO Omni-Gen® version 3.1.6 through 4.1.1

✅

✅

✅

TIBCO® Operational Intelligence Agent version 3.0.0 and above

🔍

✅

🔍 

TIBCO® Operational Intelligence Hawk® RedTail version 7.0.0 and above

🔍

✅

🔍 

TIBCO® Order Management version 5.1.0 and below

🔍

🔍 

🔍 

TIBCO® Order Management version 5.0.1 and below

🔍

✅

🔍 

TIBCO® Patterns version 5.6 and below

🔍

✅

🔍 

TIBCO® Product & Catalog version 4.1.0 and below

✅

✅

✅

TIBCO Rendezvous® - All Versions

✅

✅

✅

TIBCO® Reward version 22.2 and below

✅

✅

✅

TIBCO Runtime Agent™ version 5.12.1 and below

🔍

✅

🔍 

TIBCO Silver® Fabric - All Versions

✅

✅

✅

TIBCO Spotfire® for Amazon Web Services version 11.8.1

✅

✅

✅

TIBCO Spotfire® Analyst - All Versions

✅

✅

✅

TIBCO Spotfire® Automation Services - All Versions

✅

✅

✅

TIBCO Spotfire® Business Author - All Versions

✅

✅

✅

TIBCO Spotfire® Cloud Enterprise  version 11.7.0 and below

🔍

✅

🔍 

TIBCO Spotfire® Consumer - All Versions

✅

✅

✅

TIBCO Spotfire® Desktop - All Versions

✅

✅

✅

TIBCO Spotfire® Qualification - All Versions

✅

✅

✅

TIBCO Spotfire® Server version 11.8.0 and below

🛠️

✅

🛠️ 

TIBCO Statistica® version 14.0 and below

✅

✅

✅

TIBCO® Streaming version 10.6.2 and below

🔍

✅

🔍 

TIBCO WebFOCUS® Reporting Server - All Versions

✅

✅

✅

TIBCO WebFOCUS® Client version 9.0.1

🔍

✅

🔍