search

thelastpickle / cassandra-reaper

Automated Repair Awesomeness for Apache Cassandra
http://cassandra-reaper.io/
Apache License 2.0
490 stars 218 forks source link

Spring vulnerability #1464

Closed akki-reddy closed 10 months ago

akki-reddy commented 10 months ago

Project board link

Is cassandra-reaper vulnerable to "Vmware Spring: CVE-2022-22965: Spring Framework RCE via Data Binding" CVE?

adejanovski commented 10 months ago

cassandra-reaper is based on top of Dropwizard, it doesn't use Spring. One of our dependencies, the migration library uses Spring IIRC, but looking at the CVE the app has to be packaged as a WAR, which isn't the case, and it has to use spring-webmvc or spring-webflux, which isn't the case either. We're good then.