Spring Core on JDK9+ is vulnerable to remote code execution
Update: March 31, 2022 A patch has officially been released. https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement https://tanzu.vmware.com/security/cve-2022-22965 Overview Spring Core on JDK9+ is vulnerable to remote code execution due to a bypass for CVE-2010-1622. At the time of writing, this vulnerability is unpatched in Spring Framework and there is a public proof-of-concept available. As we have remediation advice for customers […]
Ides of March – Chariot’s Launch Day
Advances in SaaS and DevOps that transform your business also expand the attack surface—all the ways adversaries can exploit your connections to the internet or cloud. Knowing the unknowns is the first step, but the attack surface keeps changing and your risks are multiplied by ransomware and talent shortages. It’s time security goes on offense. […]