As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.
Is this something we should worry about?
https://venturebeat.com/2022/03/30/spring4shell-vulnerability-likely-to-affect-real-world-apps-analyst-says/
CVE-2022-22965
We're still evaluating the impact of this vulnerability in the ACS Stack.
It's highly unlikely that vanilla Alfresco deployment is vulnerable to this CVE, but we'll be publishing an official statement related to this topic in the next days.
Thank you for the quick reply. We'll be waiting for the official statement.
The Spring Frameworks vulnerabilities CVE-2022-22963 and CVE-2022-22965 requires special preconditions(see https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement)to be exploited. To my current knowledge, a class loading mechanism in Tomcat Common Logging allows the exploitation of this "Spring4Shell" vulnerability in the first place.
Until Alfresco has evaluated
New Tomcat versions are now available for download:Tomcat 9 (for ACS 7.0-ACS7.2):https://dlcdn.apache.org/tomcat/tomcat-9/v9.0.62/bin/apache-tomcat-9.0.62.tar.gzTomcat 8 (for ACS 6.0-ACS6.2):https://dlcdn.apache.org/tomcat/tomcat-8/v8.5.78/bin/apache-tomcat-8.5.78.tar.gz
With Apache Tomcat versions 10.0.20, 9.0.62 and 8.5.78, the WebappClassLoaderBase.getResources() method has been disabled. This prevents attacks via Spring4Shell vulnerability and as far as I know secures Alfresco Content Services against this exploit.
