[AMQ-8562] Spring4shell vulnerability mitigation

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Duplicate
• Affects Version/s: 5.16.4
• Fix Version/s: 5.17.1
• Component/s: AMQP
• Labels: security
• Assignee: Jean-Baptiste Onofré
• Reporter: Shubhangi Raut
• Created: 01/Apr/22 14:19
• Updated: 04/Apr/22 07:53
• Resolved: 04/Apr/22 07:53

Description

Severity : Sonatype CVSS 3: 9.8CVE CVSS 2.0: 0.0

Weakness : Sonatype CWE: 470

Source : Sonatype Data Research

Explanation : The spring-beans package is vulnerable to Remote Code Execution [RCE]. The constructor method in the CachedIntrospectionResults class allows the loading of arbitrary classes. A remote attacker can exploit this vulnerability to upload a malicious class and ultimately result in RCE.
This issue is due to an insufficient fix for CVE-2010-1622.
:We are still investigating other avenues of attack but out of an abundance of caution, and media attention, are releasing this advisory now.

Detection : The application is vulnerable by using this component, if using Java version 9 or above.

Mitigation: Upgrade spring version to latest available.

Issue Links

• is duplicated by: AMQ-8565 Upgrade to Spring 5.3.18