OVM Manager / Weblogic -- CVE-2019-2725 / deserialization - remote code execution vulnerability

Here is a filtered information for OVM customers, who are complaining about CVE-2019-2725, which is a deserialization vulnerability, a remote code execution vulnerability that is remotely exploitable without authentication.

I guess everyone already knows that OVM uses Weblogic in the backend. Actually this post is for all the ones who use certain versions of Weblogic..  Weblogic 10.3.6 and 12.1.3. 

The solution is simple for the ones who have extended support contract because these Weblogic releases are currently in extended support. This is the reality for both OVM Manager and Weblogic customers.

So, you just apply the latest PSU, or a PSU which fixes the issue and the overlay patch if there is any 

and that's it.. You are done .. (for instanc :e Apr 2019 PSU 12.1.3.0.190416 Patch 29204657 + Overlay Patch 29694149 on 12.1.3.0.190416 for CVE-2019-2725)

OVM Manager customer can also apply the PSU and overlays.. Although Weblogic is bundled with OVM Manager, it is supported to get latest security updates, to the latest minor updates. I mean you can apply PSUs to the Weblogic of OVM Manager..

The questions arises for the ones who don't have extended support for Weblogic. That is if they don't have extended support contract, they won't be able to download any WLS patches for those specific releases.. 

This means  no PSU, no CPU, no overlay...

In this case, they have 2 options.. 

1) They may upgrade their OVM manager to version 3.4.7, which is bundled with Weblogic 12.1.3.0.210119 -- January 2021 Patch Set Update (PSU) for WebLogic Server 12.1.3.0.

2) They may implement the following workaround (but this must be tested, I mean it must be ensured that OVM Manager will not lose any functionalities after these actions);

Delete the wls9_async_response.war & wls-wsat.war packages from Weblogic and restart the OVM Manager+ Weblogic
Disable access to“/_async/*” and “/wls-wsat/” URLs on weblogic.
Test well..

-- you may even implement this access restriction on the firewall level.

MOS References:

Upgrading products bundled with Oracle VM Manager (Doc ID 2195205.1)
Security Alert CVE-2019-2725 Patch Availability Document for Oracle WebLogic Server (Doc ID 2535708.1)