戻る
-
タイトル
Does Spring4Shell vulnerability (CVE-2022-22965) impact Stat? -
説明
Does Spring4Shell vulnerability (CVE-2022-22965) impact Stat? -
原因
Spring4Shell vulnerability (CVE-2022-22965) -
対策
STAT product is not directly impacted by this vulnerability (resteasy-spring), but it is shipping the related jar in the product.This jar was optional, and Stat do not require this jar. Plan is to remove this jar from the product in the next release.Immediate solution:Steps to remove resteasy-spring jar for 6.31. Stop SCA2. Go to location <STAT_HOME>\app\modules\system\layers\base\org\jboss\as\jaxrs\main3. Take backup of module.xml and edit module.xml. Remove following entry:<module name="org.jboss.resteasy.resteasy-spring" optional="true"/>4. Go to location <STAT_HOME>\app\modules\system\layers\base\org\jboss\resteasy5. Take backup of folder resteasy-spring and then delete this folder.6. Restart SCASteps to remove resteasy-spring jar for 6.21. Stop SCA.2. Go to location <STAT_HOME>\app\modules\system\layers\base\org\jboss\as\jaxrs\main3. Take backup of module.xml and edit module.xml. Remove following entry:<module name="org.jboss.resteasy.resteasy-spring" optional="true"/>4. Go to location <STAT_HOME>\app\modules\system\layers\base\org\jboss\resteasy5. Take backup of folder resteasy-spring and then delete this folder.6. Restart SCA. -
追加情報
https://mvnrepository.com/artifact/org.jboss.resteasy/resteasy-spring/3.7.0.Final