Skip to main content
P
PhilD-Work
Participant
April 1, 2022
Question

Spring4Shell Vulnerability

  • April 1, 2022
  • 1 reply
  • 1738 views

Do we know if ColdFusion, any supported version, is affected by the just released Spring Framework vulnerability,https://tanzu.vmware.com/security/cve-2022-22965? I need to provide updates to my InfoSec team,

 

Phil

This topic has been closed for replies.

1 reply

Charlie Arehart
Community Expert
Charlie ArehartCommunity Expert
Community Expert
April 1, 2022

While the IT world is indeed up in arms again about yet another seeming wide-ranging zero day, I'll say that as we await a reply from Adobe, it's worth noting that though both CF and Spring are based on Java, CF is not based on Spring. And as the vuln seems specific to Spring (from all I've read, since people started asking me yesterday in my role as a CF consultant), it seems therefore that this vuln does not affect CF.

 

All that said, I am not presenting any official stance, just a reasoned assertion. (In situations like this, many will be reluctant to even offer that.) I wanted to put this out as at least one take on things. 

 

Let's see if Adobe may come out with an official position, whether in reply here or in another forum thread/announcement or portal post (coldfusion.adobe.com). Or CF security maven Pete Freitag may offer his more careful assessment.

(FWIW, I had reached out earlier today to both of THEM about this, since so many are asking.) 

/Charlie (troubleshooter, carehart. org)
P
PhilD-WorkAuthor
Participant
April 1, 2022

Charlie,

I'm in agreement with your assessment of the situation and while it looks like it is limited to applications built and deployed as a WAR on Tomcat, we all know how Enterprise InfoSec folks are with "Vendor must verify" which is why I figured I'd start a thread in case others were in the same situation,

 

Phil Duba

Charlie Arehart
Community Expert
Charlie ArehartCommunity Expert
Community Expert
April 1, 2022

Of course, and that's why I prefaced my reply with, "as we await a reply from Adobe, it's worth noting"...and I even ended with the two paragraphs I did, to acknowledge that mine is NOT that Vendor verification some would seek. But to be clear, since you started with "do we know", I presumed you were asking "the community" as much as Adobe. As always, I just want to help.

/Charlie (troubleshooter, carehart. org)
Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices