Summary
It was discovered that the Spring Framework incorrectly handled web
requests via data binding. An attacker could possibly use this issue to
achieve remote code execution and obtain sensitive information.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libspring-java | 4.3.22-1~18.04.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libspring-java | 4.3.22-4ubuntu0.1~esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | libspring-java | 4.3.30-1ubuntu0.1~esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | libspring-java | 4.3.30-2ubuntu0.24.04.1~esm1 |
Vulnerabilities 1
-
Critical 9.8
Remote Code Execution in Spring Framework
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot…
KEV Apr 4, 2022
References
-
report
https://ubuntu.com/security/CVE-2022-22965