Uploaded image for project: 'mod-source-record-manager'
  1. mod-source-record-manager
  2. MODSOURMAN-923

Spring 5.2.22 fixing Spring4Shell CVE-2022-22965 (MG)

    XMLWordPrintable

Details

    • Folijet Sprint 155
    • 0
    • Folijet
    • Morning Glory (R2 2022) Hot Fix #1
    • Related dependency upgrade

    Description

      mod-source-record-manager 3.4.5 is used for Morning Glory platform-complete.

      mod-source-record-manager 3.4.5 comes with the runtime dependency spring-beans 5.2.8.RELEASE that has the Spring4Shell Remote Code Execution vulnerability, for details see FOLIO-3466 and https://nvd.nist.gov/vuln/detail/CVE-2022-22965 .

      Fix: Upgrade Spring Framework from 5.2.8.RELEASE to 5.2.22.RELEASE.

      And release as Morning Glory Hot Fix.

      Note: This issue is for fixing Spring4Shell in Morning Glory only. For Nolana (and Orchid) it has been fixed with MODSOURMAN-889.

      TestRail: Results

        Attachments

          Issue Links

            blocks

            Umbrella - FOLIO-3466 Spring4Shell: spring-beans RCE Vulnerability (CVE-2022-22965)

            • P2 - normal priority level, must be included in the current development cycle
            • Closed

            Task - A task that needs to be done. MODSOURMAN-929 Release v3.4.6 (R2 MG HF#1)

            • P2 - normal priority level, must be included in the current development cycle
            • Closed
            defines

            New Feature - New feature requests UXPROD-3725 NFR: Data Import Technical, NFR, & Misc work (Orchid R1 2023)

            • P2 - normal priority level, must be included in the current development cycle
            • Closed
            relates to

            Task - A task that needs to be done. MODDATAIMP-750 Update util dependencies

            • P3 - low priority level, item will be considered for inclusion in the next dev cycle
            • Closed

            Bug - A problem which impairs or prevents the functions of the product. MODDICONV-279 Spring 5.2.22 fixing vulnerabilities (Spring4Shell, etc.) MG

            • P2 - normal priority level, must be included in the current development cycle
            • Closed

            Bug - A problem which impairs or prevents the functions of the product. MODSOURMAN-889 folio-di-support 1.6.0 fixing Spring4Shell CVE-2022-22965

            • P2 - normal priority level, must be included in the current development cycle
            • Closed

            Activity

              People

                julianladisch Julian Ladisch
                julianladisch Julian Ladisch
                Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved:

                  TestRail: Runs

                    TestRail: Cases