search

spring-attic / spring-security-oauth

Support for adding OAuth1(a) and OAuth2 features (consumer and provider) for Spring web applications.
http://github.com/spring-projects/spring-security-oauth
Apache License 2.0
4.69k stars 4.05k forks source link

CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+ #1956

Closed Zhangmao0809 closed 2 years ago

Zhangmao0809 commented 2 years ago

hi，I know The Spring Security OAuth project is deprecated. but I still want to know. Is The Spring Security OAuth affected by rce vulnerability?

CVE-2022-22965Spring Framework RCE via Data Binding on JDK 9+ https://tanzu.vmware.com/security/cve-2022-22965

jgrandja commented 2 years ago

This project is built against JDK 1.6 and Spring Framework 4.3.30.

NOTE:

The Spring Framework RCE recommends upgrading to 5.3.18 or 5.2.20, however, the 5.x line was not fully tested with this project and may not work. As advised in the "Suggested Workarounds", downgrading to Java 8 and/or upgrading Tomcat is a viable workaround.