Your browser is not supported

For the best experience, use Google Chrome or Mozilla Firefox.

Micro Focus

Statement on CVE-2022-22965 (Spring4Shell)
Vulnerability

CVE-2022-22965 Statement

 

CVE Description: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

List of Micro Focus Products Not Impacted by CVE-2022-22965 Spring4Shell and Security Bulletins for Impacted Products

Are you aware of this new vulnerability?

Yes, and we have a robust, dedicated, full-time threat intelligence team with a Micro Focus-wide view, that is constantly reviewing new reports of vulnerabilities, threats, and compromises for possible impact to our information assets.

Have you scanned and/or currently scanning for CVE-2022-22965 and all related compromises/vulnerabilities?

Micro Focus implements a Secure Development Lifecycle that includes Supply Chain Security, 3rd Party Component Manifest and 3rd Party Component Monitoring. Using these formal practices, we help ensure that 3rd party components are sourced from trusted repositories, scanned and tested, free of known CVEs, and signed to ensure authenticity. New vulnerabilities are scanned and tracked to ensure closure. Additionally, Micro Focus has scheduled rolling scans using a variety of tools to detect a wide variety of vulnerabilities. Vendor rule sets/signatures and code are typically scrutinized after a new vulnerability announcement. We continue to get updates from our security vendors and internal security community on the latest scanning techniques for CVE-2022-22965 and other vulnerabilities. We also take a risk-based approach to prioritizing which patches get applied first.

Have you implemented or are you currently implementing patches and mitigation measures for the CVE-2022-22965 and all related vulnerabilities on targeted or potentially impacted systems?

We are prioritizing CVE-2022-22965 alongside other patch efforts. We rank potential patches according to CVSS scoring, and also our own enhanced scoring system that takes additional data points into account. Configuration changes or patch installations require Quality Assurance analysis and testing prior to deployment to production systems to prevent unexpected service interruptions.

Have you identified that there are no indications of compromise related to CVE-2022-22965 or any related vulnerabilities on the targeted or potentially impacted systems?

At present, we are not aware of any current indications of compromise related to CVE-2022-22965 or related vulnerabilities.

Has any data currently in your possession as part of the agreed provision of services to the customer been improperly accessed or disclosed as result of CVE-2022-22965 or any related vulnerabilities?

At present, we are not aware of any improper access or disclosure of customer data related to CVE-2022-22965 or any related vulnerabilities.

Updates on CVE-2022-22965

April 4, 2022

Micro Focus continues to monitor CVE-2022-22965 vulnerability closely and issues appropriate patches, security bulletins and communications to support our customers. As this is a still evolving situation we will monitor and actively address changes. Keep watching the Micro Focus Security Bulletins for any changes resulting from further industry analysis of this vulnerability. Micro Focus is committed to continue to provide prompt remediation if the situation develops further. We will periodically update this page to ensure you have the latest information on our status.

List of Micro Focus Products Not Impacted by CVE-2022-22965 Spring4Shell and Security Bulletins for Impacted Products

If you don’t see your product listed, please come back for updates. Please contact support if urgent.

release-rel-2022-6-2-hotfix-7662 | Thu Jun 30 00:48:29 PDT 2022
7662
release/rel-2022-6-2-hotfix-7662
Thu Jun 30 00:48:29 PDT 2022
AWS