Which JDK versions are susceptible to Spring4Shell exploitation?

Question

The Spring4Shell vulnerability, encompassing CVE-2022-22965 and CVE-2022-22963, specifically impacts applications leveraging the Spring Framework and Spring Cloud Function. Exploitation of this zero-day vulnerability is contingent on several factors, including the Java Development Kit (JDK) version in use. The documented conditions for successful exploitation indicate that JDK 9 and later versions are susceptible, primarily due to the mechanism of data binding. This dependency on newer JDK versions means that environments utilizing older, unsupported JDKs may not be directly exposed to this particular attack vector.

Accepted Answer

The vulnerability's reach extends to specific versions of the Spring Framework and its related components. For the Spring Core vulnerability (CVE-2022-22965), affected versions include Spring Framework 5.3.0 through 5.3.17, as well as versions 5.2.0 through 5.2.19. Older, unpatched versions of the Spring Framework are also considered vulnerable. Concurrently, Spring Cloud Function versions 3.1.6 and 3.2.2, along with other older, unsupported iterations, are susceptible to CVE-2022-22963. It is important to note that the precise conditions for exploitation are based on observed proof-of-concept (PoC) examples, and the general nature of the vulnerability suggests that other exploitation scenarios might exist.

Reading history

Hide →

This history is cleared when the page is closed.

Which JDK versions are susceptible to Spring4Shell exploitation?

Loading

Was this article helpful?

Helpful

Not helpful

Report an issue

1

0

0

Share with friends