Critical Remote Code Execution Vulnerability in libspring-java Package
Summary
UBUNTU-CVE-2022-22965: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. Affects libspring-java versions < 4.3.22-1~18.04.1~esm1. Fixed in 4.3.22-1~18.04.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libspring-java package is a core component of the Spring Framework, widely used for building Java applications. It provides comprehensive infrastructure support for developing Java applications, including features for web applications, data access, and transaction management. This package is essential for developers utilizing Spring MVC or Spring WebFlux for their projects. However, it is vulnerable to a critical security flaw that could allow remote code execution under specific conditions.
Vulnerability Detail
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. This vulnerability arises when the application is deployed on Tomcat as a WAR file. If the application is deployed as a Spring Boot executable jar, it is not susceptible to this exploit. The implications of this vulnerability are severe, as it could allow an attacker to execute arbitrary code on the server, leading to potential data breaches or system compromise.
How To Fix
Minimum fixed version
4.3.22-1~18.04.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libspring-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider deploying your Spring application as an executable jar instead of a WAR file on Tomcat to mitigate the risk of this vulnerability until a patch is applied.
Conclusion
The libspring-java package is critical for Java application development, but it is currently affected by a severe remote code execution vulnerability. It is crucial for developers to update their packages to the patched versions and consider workarounds until the updates can be applied. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for libspring-java →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow attackers to execute arbitrary code on the server, potentially leading to data breaches or complete system compromise.
Yes, the vulnerability affects Spring applications running on JDK 9 or higher.
If immediate updates are not possible, consider deploying your application as an executable jar instead of a WAR file to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-java.
