Hacker News new | ask | show | jobs
A Technical Analysis of How Spring4Shell (CVE-2022-22965) Works (extrahop.com)
14 points by cws 1541 days ago
5 comments
alipitch 1528 days ago
Are there any data binding libraries (deserialization, marshaling, pickling libraries) that do not have the class of weaknesses as the two CVEs (CVE-2022-22965, CVE-2010-1622)?

If there are any for Java, can they be used with Spring Boot (Spring Framework)? Maybe there are some for in another programming language?

link
ajdenver 1541 days ago
I've been told it can be hard to know if vendor-built apps in your environment are using Spring. What are some apps built on this platform?
link
PeekPoke 1541 days ago
That's a good technical write-up. I wonder how much of an issue this CVE will be compared to Log4Shell....
link
cws 1541 days ago
Depends a lot on how many Spring apps out there have the prereqs to be vulnerable. The widespread nature of Log4Shell is what made it “worse” than other RCE vulns. I don’t have a sense of how many vulnerable instances of this one might be out there but the number could be enormous.
link
cws 1541 days ago
This is about CVE-2022-22965. Maybe I’ll edit the title to reflect that.
link
ajdenver 1541 days ago
good idea.
link
rpple 1541 days ago
Whether or not this turns out to have the same blast radius and Log4Shell, it has certainly captured a lot of attention. Lots and lots of folks using Tomcat...
link