topic Spring4Shell Bug - yes another Log4J issue in Threats

Spring4Shell Bug - yes another Log4J issue

Caute_cautim — Mon, 09 Oct 2023 10:08:31 GMT

Hi All

It looks like another Spring for Java development has sprung up, even though it is Autumn in the Southern Hemisphere. It looks very much another extension to Log4J and Spring for Cloud with serious consequences.

https://threatpost.com/critical-rce-bug-spring-log4shell/179173/

Regards

Caute_Cautim

Re: Spring4Shell Bug - yes another Log4J issue

csjohnng — Fri, 01 Apr 2022 15:18:30 GMT

Yes, will be another busy week.... there are 2 related CVEs and the RCE is really bad, even worst than the log4shell

https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/

virtual patching and patching...

Re: Spring4Shell Bug - yes another Log4J issue

AppDefects — Sat, 02 Apr 2022 12:50:43 GMT

Here is an analysis (one of many out there) that describes the similarities with Log4j. This one describes the exploit scenario associated with Spring Core and the dependencies

Re: Spring4Shell Bug - yes another Log4J issue

Caute_cautim — Thu, 07 Apr 2022 06:11:38 GMT

HI All

This is a follow up to to my original piece - it appears the number of systems affected is far greater than organisations anticipated. Some sleepless nights for many.

https://www.darkreading.com/application-security/vulnerable-spring-framework-instances-estimated-at-possibly-millions

Regards

Caute_Cautim