Product: CA PKI 5.2.8 (Common Component)
Two vulnerabilities CVE-2022-22965 and CVE-2022-22963 have been reported on Spring Framework.
CVE-2022-22965: Spring Framework RCE via Data Binding on JDK 9+
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring Expression
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
What is the impact on CAPKI?
All Supported Versions
CAPKI does not use Spring and is not affected by Spring4Shell ZERO-day exploit CVE-2022-22963 and CVE-2022-22965