Zurück
-
Titel
Does Spring4Shell vulnerability (CVE-2022-22965) impact Stat? -
Beschreibung
Does Spring4Shell vulnerability (CVE-2022-22965) impact Stat? -
Ursache
Spring4Shell vulnerability (CVE-2022-22965) -
Lösung
STAT product is not directly impacted by this vulnerability (resteasy-spring), but it is shipping the related jar in the product.This jar was optional, and Stat do not require this jar. Plan is to remove this jar from the product in the next release.Immediate solution:Steps to remove resteasy-spring jar for 6.31. Stop SCA2. Go to location <STAT_HOME>\app\modules\system\layers\base\org\jboss\as\jaxrs\main3. Take backup of module.xml and edit module.xml. Remove following entry:<module name="org.jboss.resteasy.resteasy-spring" optional="true"/>4. Go to location <STAT_HOME>\app\modules\system\layers\base\org\jboss\resteasy5. Take backup of folder resteasy-spring and then delete this folder.6. Restart SCASteps to remove resteasy-spring jar for 6.21. Stop SCA.2. Go to location <STAT_HOME>\app\modules\system\layers\base\org\jboss\as\jaxrs\main3. Take backup of module.xml and edit module.xml. Remove following entry:<module name="org.jboss.resteasy.resteasy-spring" optional="true"/>4. Go to location <STAT_HOME>\app\modules\system\layers\base\org\jboss\resteasy5. Take backup of folder resteasy-spring and then delete this folder.6. Restart SCA. -
Weitere Informationen
https://mvnrepository.com/artifact/org.jboss.resteasy/resteasy-spring/3.7.0.Final