Data Protection Advisor: Spring Framework and Spring4Shell False Positive Security Vulnerabilities (CVE-2022-22965, CVE-2022-22963)
Summary: Data Protection Advisor: Spring Framework and Spring4Shell False Positive Security Vulnerabilities (CVE-2022-22965, CVE-2022-22963)
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Security Article Type
Security KB
CVE Identifier
CVE-2022-22965, CVE-2022-22963
Issue Summary
See the 'Recommendation' section below for details on each CVE.
Details
The vulnerabilities listed in the table below are in order by the date on which Data Protection Advisor Engineering determined that the Data Protection Advisor 19.6,19.5,19.4,19.3,19.2,18.x was not vulnerable.
| Component | CVE ID | Summary of Vulnerability | Reason why Product is not Vulnerable | Date Determined False Positive |
|---|---|---|---|---|
| DPA Application DPA Datastore DPA Agent |
CVE-2022-22963 | Remote code execution in Spring Cloud Function by malicious Spring Expression | This CVE requires use of the Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions. DPA does not include the Spring Cloud Function library. |
April 7, 2022 |
| DPA Application DPA Datastore DPA Agent |
CVE-2022-22965 | Spring Framework Remote Code Execution via Data Binding on JDK 9+ | This CVE requires the use of JDK version 9 or higher. DPA does not use JDK 9+. | April 7, 2022 |
Legal Disclaimer
Article Properties
Article Number: 000199055
Article Type: Security KB
Last Modified: 13 Jun 2022
Version: 1
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.