search

thelastpickle / cassandra-reaper

Automated Repair Awesomeness for Apache Cassandra
http://cassandra-reaper.io/
Apache License 2.0
481 stars 216 forks source link

Spring vulnerability #1464

Closed akki-reddy closed 5 months ago

akki-reddy commented 5 months ago

Project board link

Is cassandra-reaper vulnerable to "Vmware Spring: CVE-2022-22965: Spring Framework RCE via Data Binding" CVE?

adejanovski commented 5 months ago

cassandra-reaper is based on top of Dropwizard, it doesn't use Spring. One of our dependencies, the migration library uses Spring IIRC, but looking at the CVE the app has to be packaged as a WAR, which isn't the case, and it has to use spring-webmvc or spring-webflux, which isn't the case either. We're good then.