Return
-
Title
Spring Framework vulnerability issue - CVE-2022-22965 -
Description
Spotlight products are not impacted by the Spring Framework Java related security issue - CVE-2022-22965 -
Cause
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. -
Resolution
The following Spotlight products are not impacted by this security issue (CVE-2022-22965), since they do not use the Spring Framework.Unaffected products:Spotlight on SQL Server
Spotlight Cloud
Spotlight Tuning Pack
Spotlight on Oracle
Spotlight on SAP
Spotlight on DB2 LUW
-
NOTE
This is a "Quick Share" article provided by Quest Support. All content included in this article is unverified and provided “as is” for information purposes only. Although reasonable efforts have been made to present complete, current and accurate content, no guarantees for the completeness, currency or accuracy of this content is made. Accordingly, Quest makes no representation, warranty or endorsement of any kind regarding this content, whether express or implied, including but not limited to the implied warranties of satisfactory quality, fitness for a particular purpose, non-infringement, compatibility, security, accuracy or completeness.