Spring Framework remote code execution vulnerability risk notification

2023-03-31

Respectful master's command:

Pleasure! Spring Official Public Safety Announcement, Announcement of Spring Framework Existence, Introducing JDK 9 and above versions, Existence in the environment of JDK 9 and above version (CVE-2022-22965).

[Vulnerability Rating]

High risk

[Vulnerability description]

CVE-2022-22965

Official explanation, the main influence on the use of excretory leakage in front of JDK 9+ upward running Spring MVC and Spring WebFlux usage procedure. The successful use of the tunnel requires the use of the procedure and the WAR department is running on Tomcat.

[scope of influence]

Affected versions:

Spring Framework 5.3.x < 5.3.18

Spring Framework 5.2.x < 5.2.20

Unused JDK version >= 9

(Other lower versions of Spring Framework may be affected)

[Repair Plan]

A safe version has been officially released. Affected users are advised to upgrade Spring Framework to a safe version:

https://github.com/spring-projects/spring-framework/tags

[Reference link]

https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

https://tanzu.vmware.com/security/cve-2022-22965

Back to List