Payara Platform & “Spring4Shell”
Originally published on 06 Apr 2022
Last updated on 08 Apr 2022
![Photo of Fabio Turizo](https://blog.payara.fish/hs-fs/hubfs/Fabio.jpg?width=200&name=Fabio.jpg)
The Remote Code Execution (RCE) vulnerability detected in the Spring Java Framework in March 2022 (tagged as CVE-2022-22965) is unlikely to impact those using Payara Platform.
However, users that deploy Spring Framework WAR packaged applications in Payara Server are affected by this vulnerability as Payara Server shares pieces of code in its Servlet implementation, Catalina, which was originally branched from Apache Tomcat.
To mitigate the risk of being impacted by this vulnerability, we have implemented an urgent fix that effectively disables the affected code in the corresponding Catalina modules. This hotfix will be included in the upcoming releases of both Payara Community (5.2022.2) and Payara Enterprise (5.38)
Please note: Users must also apply the fixes issued in Spring Framework 5.3.18 and 5.2.20, available inSpring Boot 2.6.6. as per their recommendations, to be fully protected.
Read more about the vulnerability here:
https://venturebeat.com/2022/04/01/spring4shell-vulnerability-should-you-patch/
Find more resources here for increasing the security of your applications:
Related Posts
The Payara Monthly Catch - August 2024
Published on 29 Aug 2024
by Chiara Civardi
0 Comments
Join Live Webinar - Simplifying Security for Your Jakarta EE Applications with Apache Shiro
Published on 26 Aug 2024
by Dominika Tasarz
0 Comments
Join us for an insightful webinar with Lenny Primak & Luqman Saeed, where we'll demystify security for your Jakarta EE applications using Apache Shiro.