# Springshell Vulnerability Update **URL:** \ **Category:** Community Announcements\ **Tags:** springshell\ **Created:** [March 31, 2022, 4:11pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453 "2022-03-31T16:11:07Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![mfrost](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/mfrost/32/1701_2.png) [@mfrost](https://community.sonatype.com/u/mfrost)\ **Post date:** [March 31, 2022, 4:11pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/1 "2022-03-31T16:11:07Z")
Hi Sonatype Community, Early Wednesday morning (GMT), allegations began to appear on the Internet about a new remote code execution flaw that affects **Spring Framework**. This vulnerability, dubbed by some as “Springshell” in the community, is a new, previously unknown security vulnerability. The vulnerability affects the **spring-beans** and **spring** artifacts, an extremely popular framework used widely in Java applications, and seems to require JDK9 or newer to be running. It is a bypass for an older CVE, CVE-2010-1622 that due to a feature in JDK9 or newer seems to have been reinstated. The vulnerability was confirmed on Wednesday and It has been added to Sonatype data as **SONATYPE-2022-1764** and given the designation **CVE-2022-22965**. Spring has acknowledged the vulnerability and released **5.3.18** and **5.2.20** to patch the issue. **We recommend an immediate upgrade for all users.** Customers who have scanned their applications with Nexus Lifecycle will receive **automatic security alerts** as a part of their usual continuous monitoring. If you have Continuous Monitoring turned on, you are protected. **UPDATE:** Sonatype solutions are not affected by the Spring4shell vulnerability. **Unsure if your organization is impacted?** See our [Find & Fix Springshell guide](https://bit.ly/36CKYwJ) for help as you investigate your applications and environments for this vulnerability. For continuing updates and additional information, please visit [this Sonatype blog post](https://blog.sonatype.com/new-0-day-spring-framework-vulnerability-confirmed). * * * If you have any additional questions, we are happy to answer them in the thread below. ---
**Author:** ![mfrost](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/mfrost/32/1701_2.png) [@mfrost](https://community.sonatype.com/u/mfrost)\ **Post date:** [March 31, 2022, 4:11pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/2 "2022-03-31T16:11:27Z")
Pinned globally on March 31, 2022, 4:11pm UTC ---
**Author:** ![zied.ellouze](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/zied.ellouze/32/2229_2.png) [@zied.ellouze](https://community.sonatype.com/u/zied.ellouze)\ **Post date:** [April 1, 2022, 5:11pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/3 "2022-04-01T17:11:30Z")
The vulnerability is not detected by ossindex-maven ---
**Author:** ![mfrost](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/mfrost/32/1701_2.png) [@mfrost](https://community.sonatype.com/u/mfrost)\ **Post date:** [April 4, 2022, 3:39pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/4 "2022-04-04T15:39:50Z")
Pinned globally on April 4, 2022, 3:39pm UTC ---
**Author:** ![mfrost](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/mfrost/32/1701_2.png) [@mfrost](https://community.sonatype.com/u/mfrost)\ **Post date:** [April 4, 2022, 6:56pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/5 "2022-04-04T18:56:33Z")
Hi @zied.ellouze and welcome to the Community! Thanks for bringing this to our attention. The CVE is currently awaiting analysis at NIST so it does not have the key information required by OSSIndex (such as the impacted components). Our team will need to hand-jam that data to get it in faster this time. Soon, we’ll be changing research pipelines where this sort of thing will be resolved much faster in the future. ---
**Author:** ![silviatejera](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@silviatejera](https://community.sonatype.com/u/silviatejera)\ **Post date:** [April 22, 2022, 8:30am UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/6 "2022-04-22T08:30:33Z")
Hi Maura, Just using the eclipse plugin to solve this issue I updated our spring-framework version to the latest 5.3.19 instead of suggested by IQ Sonatype 5.2.3, but issue still appears in red and even when I ran the war as ad-hoc it still gives me that is something wrong, but suggested libraries are already part of the proyect because I updated those libraries as well: - org.springframework.data : spring-data-rest-webmvc : 3.6.4 - org.springframework.security : spring-security-taglibs : 5.6.3 ![image](https://canada1.discourse-cdn.com/flex047/uploads/communitysonatype/original/2X/0/0155cc117bdd7367d95efc15d83c14ca6b31962b.png) Can you please let me know if this is a bug or what is the problem with using latest version of libraries suggested on [https://tanzu.vmware.com/security/cve-2022-22965](https://tanzu.vmware.com/security/cve-2022-22965), Thanks Silvia ---
**Author:** ![mfrost](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/mfrost/32/1701_2.png) [@mfrost](https://community.sonatype.com/u/mfrost)\ **Post date:** [April 22, 2022, 3:44pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/7 "2022-04-22T15:44:28Z")
Hi @silviatejera and welcome! I did chat with our team about this. From the screenshot you’ve posted, it’s showing that spring-web is at 5.3.19, but still has a vulnerability. This is actually true. While org.springframework:spring-web:5.3.19 is not vulnerable to CVE-2022-22965, it is vulnerable to CVE-2016-1000027, hence why you are still seeing the red square (i.e. still showing a policy violation). Hope this helps a bit. ---
**Author:** ![william.taylor](https://avatars.discourse-cdn.com/v4/letter/w/bcef8e/32.png) [@william.taylor](https://community.sonatype.com/u/william.taylor)\ **Post date:** [April 22, 2022, 5:28pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/8 "2022-04-22T17:28:24Z")
That was helpful indeed; I have to get better at drilling down into your reports, thanks. BTW, your messages say “log in to reply or reply to this email.” Email replies are VASTLY to be preferred - I have more passwords than I could possibly imagine - but the return email address you use is no reply. PLEASE have your web wizards fix it to I can reply, and they put it in the chat so i don’t have to log in. ---
**Author:** ![mfrost](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/mfrost/32/1701_2.png) [@mfrost](https://community.sonatype.com/u/mfrost)\ **Post date:** [April 22, 2022, 6:27pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/9 "2022-04-22T18:27:53Z")
Glad it was helpful, William! We will take a look at the reply by email functionality and get it working again. Thanks for letting us know about that & stay tuned! ---
**Author:** ![silviatejera](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@silviatejera](https://community.sonatype.com/u/silviatejera)\ **Post date:** [April 24, 2022, 10:19pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/10 "2022-04-24T22:19:07Z")
Hi Maura, Thanks for your answer, but sorry, it doesn’t really help as that is the latest version published for version 5.3.x and as I said when you go deeper on the IQ tool to find out what is the issue, suggested libraries by the tool are already part of the project. Cannot understand why latest version have issues but not 5.2.3, which is lower. Should we use a lower version instead of the newest? Thanks Silvia ---
**Author:** ![mfrost](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/mfrost/32/1701_2.png) [@mfrost](https://community.sonatype.com/u/mfrost)\ **Post date:** [April 25, 2022, 2:50pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/11 "2022-04-25T14:50:48Z")
@silviatejera There are times when a lower version has no known vulnerabilities, but all newer versions have a vulnerability. This is an example of that. Let’s say that a component had no known vulnerabilities at all and then a new vulnerability came out affecting the latest version, and let’s say the latest version is 4.2. The 3.x versions are not vulnerable as the vulnerable code got introduced in version 4.0. In this case, you **would** probably want to stay on the lower 3.x versions until a fix came out for the vulnerability affecting the 4.x versions. ---
**Author:** ![silviatejera](https://avatars.discourse-cdn.com/v4/letter/s/d26b3c/32.png) [@silviatejera](https://community.sonatype.com/u/silviatejera)\ **Post date:** [April 25, 2022, 5:24pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/12 "2022-04-25T17:24:53Z")
Thanks Maura Harwood, I’ll do that, probably I still have to learn how to learn how to read recommendations, as recommended version after changing to 5.3.19 for this was not springframewok 5.2.3, instead it was telling me about - org.springframework.data : spring-data-rest-webmvc : 3.6.4 - org.springframework.security : spring-security-taglibs : 5.6.3 Thanks again Silvia ---
**Author:** ![zied.ellouze](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/zied.ellouze/32/2229_2.png) [@zied.ellouze](https://community.sonatype.com/u/zied.ellouze)\ **Post date:** [April 25, 2022, 6:06pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/13 "2022-04-25T18:06:05Z")
Hi, Normally version 5.3.19 is not vulnerable [https://mvnrepository.com/artifact/org.springframework/spring-web/5.3.19](https://mvnrepository.com/artifact/org.springframework/spring-web/5.3.19)