Thread: Information to CVE-2022-42889

- facebook.de/barmenia - xing.de/companies/barmenia - twitter.com/barmenia - youtube.de/barmenia

Barmenia Allgemeine Versicherungs-AG
Vorstand: Dr. Andreas Eurich (Vorsitzender) - Frank Lamsfuß - Ulrich Lamy - Carola Schroeder
Aufsichtsrats-Vorsitzender: Dr. h. c. Josef Beutelmann; Rechtsform des Unternehmens: Aktiengesellschaft
Sitz: Wuppertal; Amtsgericht Wuppertal HRB 3033; USt.-Identifikationsnummer: DE 811425914; Versicherungsteuernummer: 810/V90810006337 　

Barmenia Krankenversicherung AG
Vorstand: Dr. Andreas Eurich (Vorsitzender) - Frank Lamsfuß - Ulrich Lamy - Carola Schroeder
Aufsichtsrats-Vorsitzender: Dr. h. c. Josef Beutelmann; Rechtsform des Unternehmens: Aktiengesellschaft
Sitz: Wuppertal; Amtsgericht Wuppertal HRB 28475; USt.-Identifikationsnummer: DE 121102508 　

Barmenia Lebensversicherung a. G.
Vorstand: Dr. Andreas Eurich (Vorsitzender) - Frank Lamsfuß - Ulrich Lamy - Carola Schroeder
Aufsichtsrats-Vorsitzender: Dr. h. c. Josef Beutelmann; Rechtsform des Unternehmens: Versicherungsverein auf Gegenseitigkeit
Sitz: Wuppertal; Amtsgericht Wuppertal HRB 3854; USt.-Identifikationsnummer: DE 121102516

> On 08/11/2022 11:50 CET Cedric Aaron Towstyka <cedric-aaron.towstyka@barmenia.de> wrote:
>
> the german bureau for IT-Security "BSI" (Bundesamt für Sicherheit in der
> Informationstechnik) has issued a warning for CVE CVE-2022-42889with the name
> commons-text. Insurance companies are obliged to analyse the installed
> software for vulnerabilities of this type.  As the Barmenia is using your
> product PostgreSQL Server it is necessary to obtain all information regarding
> any vulnerability against above CVE.  We kindly ask you to provide information
> if the above product is affected by the CVE and if yes, when a fix will be
> available.

Postgres does not use Java and should not be affected.  Maybe if you use
PL/Java[1].

This CVE reminds me of Log4j from last year[2].

[1] https://tada.github.io/pljava/
[2] https://www.postgresql.org/message-id/flat/30390f0b07fd4d90b1aacb683ebfae45%40pictet.com

--
Erik

> the german bureau for IT-Security "BSI" (Bundesamt für Sicherheit in der Informationstechnik) has issued a warning
forCVE CVE-2022-42889 with the name commons-text. Insurance companies are obliged to analyse the installed software for
vulnerabilitiesof this type. 
As the Barmenia is using your product PostgreSQL Server it is necessary to obtain all information regarding any
vulnerabilityagainst above CVE. 
We kindly ask you to provide information if the above product is affected by the CVE and if yes, when a fix will be
available.
 
> With the request for short-term feedback.

It might be prudent for Barmenia, a large insurance company, to consider
purchasing commercial support rather than requesting short-term feedback
from volunteers.

Other than that there's also excellent documentation and freely
inspectable source code.

Best regards,
Karsten