search

swri-robotics / bag-database

A server that catalogs bag files and provides a web-based UI for accessing them.
Other
342 stars 71 forks source link

Spring4Shell vulnerability #181

Open RonaldEnsing opened 2 years ago

RonaldEnsing commented 2 years ago

Is bag-database affected by the Spring4Shell vulnerability?

pjreed commented 2 years ago

Probably not. I have run a few tests on it ( https://github.com/BobTheShoplifter/Spring4Shell-POC and https://twitter.com/RandoriAttack/status/1509298490106593283 ) and they failed to exploit any vulnerabilities.

With that said, the Bag Database is using a fairly old version of Spring Core (5.0.2), so I'll take a look into what needs to be done to update that just to be safe.