Vulnerability Update - Spring4Shell (CVE-2022-22963)

Owned by Karen Hogan (Unlicensed)
Last updated: Oct 05, 2023 by Adam Voakes
1 min read

Background

Spring is a very popular application framework that allows software developers to quickly and easily develop Java applications with enterprise-level features. These applications can then be deployed on servers, such as Apache Tomcat, as stand-alone packages with all the required dependencies.

Events

To help keep customers informed of our latest responses to the Spring4Shell issue, we have created an events table to detail the key steps we have/are taking;

Date

Event

Date

Event

Apr 1, 2022

We became aware of a vulnerability known as Spring4Shell (CVE-2022-22963), and we’re closely monitoring this

Currently, with the information available on Spring4Shell, we do not believe the Dashboard will be vulnerable. This is because of following reasons:

  • The requirement for JDK9+ which we do not yet support

  • We do not directly use Spring and investigation by Grails, which we do use, has determined they are not affected because they have their own implementation of the affected area

  • We will be shortly making available the very latest release of Tomcat which contains additional fixes which would provide a further layer of protection. In addition to this, we are continually working on dependency upgrades to ensure the latest fixes are in place