kritisch
CVE-2022-22965
spring-framework: RCE via Data Binding on JDK 9+
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Red Hat (hoch), Ubuntu (hoch).
Beschreibung
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.springframework.boot:spring-boot-starter-web, org.springframework.boot:spring-boot-starter-webflux, org.springframework:spring-beans und 2 weitere | 2.5.12, 2.6.6 und 1 weitere |
| debian 11 | libspring-java | kein Fix angegeben |
| debian 12 | libspring-java | kein Fix angegeben |
| debian 13 | libspring-java | kein Fix angegeben |
| debian 14 | libspring-java | kein Fix angegeben |
| echo | libspring-java | kein Fix angegeben |
| rapidfort debian 12 | libspring-java | kein Fix angegeben |
| rapidfort debian 13 | libspring-java | kein Fix angegeben |
| Red Hat | rhvm-dependencies | kein Fix angegeben |
| seal maven::Seal Security Database | org.springframework:spring, seal.sp1.org.springframework:spring | 2.5.6+sp2p2 und 1 weitere |
| ubuntu 18.04-ESM | libspring-java | 4.3.22-1~18.04.1~esm1 |
| ubuntu 20.04-ESM | libspring-java | 4.3.22-4ubuntu0.1~esm1 |
Alle 24 Einträge aus 19 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| maven::GitHub Security Advisory Maven | org.springframework.boot:spring-boot-starter-web | 2.5.12, 2.6.6 |
| maven::GitHub Security Advisory Maven | org.springframework.boot:spring-boot-starter-webflux | 2.5.12, 2.6.6 |
| maven::GitHub Security Advisory Maven | org.springframework:spring-beans | 5.2.20.RELEASE, 5.3.18 |
| maven::GitHub Security Advisory Maven | org.springframework:spring-webflux | 5.2.20.RELEASE, 5.3.18 |
| maven::GitHub Security Advisory Maven | org.springframework:spring-webmvc | 5.2.20.RELEASE, 5.3.18 |
| debian 11 | libspring-java | kein Fix angegeben |
| debian 12 | libspring-java | kein Fix angegeben |
| debian 13 | libspring-java | kein Fix angegeben |
| debian 14 | libspring-java | kein Fix angegeben |
| echo | libspring-java | kein Fix angegeben |
| rapidfort debian 12 | libspring-java | kein Fix angegeben |
| rapidfort debian 13 | libspring-java | kein Fix angegeben |
| Red Hat | rhvm-dependencies | kein Fix angegeben |
| seal maven::Seal Security Database | org.springframework:spring | 2.5.6+sp2p2 |
| seal maven::Seal Security Database | seal.sp1.org.springframework:spring | 2.5.6+sp999 |
| ubuntu 18.04-ESM | libspring-java | 4.3.22-1~18.04.1~esm1 |
| ubuntu 20.04-ESM | libspring-java | 4.3.22-4ubuntu0.1~esm1 |
| ubuntu 22.04 | libspring-java | kein Fix angegeben |
| ubuntu 24.04 | libspring-java | kein Fix angegeben |
| ubuntu 24.10 | libspring-java | 4.3.30-2ubuntu0.24.10.1 |
| ubuntu 25.04 | libspring-java | 4.3.30-2ubuntu1 |
| ubuntu 25.10 | libspring-java | 4.3.30-2ubuntu1 |
| ubuntu 26.04 | libspring-java | 4.3.30-2ubuntu1 |
| ubuntu 26.10 | libspring-java | 4.3.30-2ubuntu1 |
Referenzen
- http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html
- http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html
- https://access.redhat.com/security/cve/CVE-2022-22965
- https://bugalert.org/content/notices/2022-03-30-spring.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf
- https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12
- https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6
- https://github.com/spring-projects/spring-framework
Alle 26 Referenzen
- https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15
- https://github.com/spring-projects/spring-framework/issues/28260
- https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE
- https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18
- https://nvd.nist.gov/vuln/detail/CVE-2022-22965
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005
- https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
- https://tanzu.vmware.com/security/cve-2022-22965
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67
- https://ubuntu.com/security/notices/USN-7165-1
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965
- https://www.cve.org/CVERecord?id=CVE-2022-22965
- https://www.cyberkendra.com/2022/03/spring4shell-details-and-exploit-code.html
- https://www.kb.cert.org/vuls/id/970766
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.praetorian.com/blog/spring-core-jdk9-rce/