'Spring4Shell: Security Analysis of the latest Java RCE '0-day' vulnerabilities in Spring (CVE-2022-22965 and CVE-2022-22963)
Regarding the "spring4shell" vulnerability in https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/ . Does anyone know if this vulnerability affects JFrog Artifactory Cloud or On-Premise versions?
Have searched support but have not seen an official response as yet hence asking the question more publicly.
Solution 1:[1]
The JFrog Platform (including Artifactory) is not affected by the Spring4Shell vulnerability (CVE-2022-22965) and Spring Cloud Function vulnerability (CVE-2022-22963),
This covers both the cloud version and the on-prem one (which share the same code base).
EDIT: Added link to a detailed remediation cookbook. Thx @tomek-tajne
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 |