search

spring-projects / spring-net

Spring Framework for .NET
http://www.springframework.net
Apache License 2.0
846 stars 375 forks source link

Question about CVE-2022-22950: Spring Expression DoS Vulnerability #220

Closed ju29robot closed 2 years ago

ju29robot commented 2 years ago

Hello, our .NET applications make heavily use of Spring.NET (Core, Data, Aop, Wcf services, MVC 5 support, Quartz.NET). We also use spEL to evaluate string values with a logic of placeholders replacements.

Regarding the vulnerability CVE-2022-22950: Spring Expression DoS Vulnerability, I'm quite confident that this problem doesn't affect our applications but some of our customers asked us to provide reassurances about this issue.

Before giving an answer, however, I would like to have your opinion about it.

Thank you very much for your support.

lahma commented 2 years ago

Based on the version in the CVE, probably not. Spring.NET is version 3.x currently and that CVE describes version 5.x.