Are there any data binding libraries (deserialization, marshaling, pickling libraries) that do not have the class of weaknesses as the two CVEs (CVE-2022-22965, CVE-2010-1622)?
If there are any for Java, can they be used with Spring Boot (Spring Framework)? Maybe there are some for in another programming language?
Depends a lot on how many Spring apps out there have the prereqs to be vulnerable. The widespread nature of Log4Shell is what made it “worse” than other RCE vulns. I don’t have a sense of how many vulnerable instances of this one might be out there but the number could be enormous.
Whether or not this turns out to have the same blast radius and Log4Shell, it has certainly captured a lot of attention. Lots and lots of folks using Tomcat...
Comments
Are there any data binding libraries (deserialization, marshaling, pickling libraries) that do not have the class of weaknesses as the two CVEs (CVE-2022-22965, CVE-2010-1622)?
If there are any for Java, can they be used with Spring Boot (Spring Framework)? Maybe there are some for in another programming language?
I've been told it can be hard to know if vendor-built apps in your environment are using Spring. What are some apps built on this platform?
That's a good technical write-up. I wonder how much of an issue this CVE will be compared to Log4Shell....
Depends a lot on how many Spring apps out there have the prereqs to be vulnerable. The widespread nature of Log4Shell is what made it “worse” than other RCE vulns. I don’t have a sense of how many vulnerable instances of this one might be out there but the number could be enormous.
This is about CVE-2022-22965. Maybe I’ll edit the title to reflect that.
good idea.
Whether or not this turns out to have the same blast radius and Log4Shell, it has certainly captured a lot of attention. Lots and lots of folks using Tomcat...