CVE-2022-22950: Input Validation
First published: Mon Mar 28 2022(Updated: )
A flaw was found in the Spring Framework. This flaw allows an attacker to craft a special Spring Expression, causing a denial of service.
Credit: security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/ovirt-dependencies | <0:4.5.2-1.el8e | 0:4.5.2-1.el8e |
| VMware Spring Framework | <5.2.20 | |
| VMware Spring Framework | >=5.3.0<5.3.17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-22950 https://nvd.nist.gov/vuln/detail/CVE-2022-22950
- https://bugzilla.redhat.com/show_bug.cgi?id=2069414
- https://access.redhat.com/errata/RHSA-2022:5532
- https://access.redhat.com/errata/RHSA-2022:5903
- https://access.redhat.com/errata/RHSA-2022:5555
- https://access.redhat.com/errata/RHSA-2022:8761
- https://access.redhat.com/security/cve/cve-2022-22950
- https://tanzu.vmware.com/security/cve-2022-22950
- https://gitlab.cee.redhat.com/rhsm/automatic-registration/blob/master/pom.xml
- https://gitlab.cee.redhat.com/rhsm/automatic-registration/blob/production/pom.xml
- https://quay.io/cloudservices/rhsm-subscriptions:28e1945
- https://quay.io/cloudservices/swatch-system-conduit:latest
- https://exchange.xforce.ibmcloud.com/vulnerabilities/223096
- https://www.ibm.com/support/pages/node/7144861 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-22950?
CVE-2022-22950 is a vulnerability found in the Spring Framework that allows an attacker to craft a special Spring Expression Language (SpEL) expression that may cause a denial of service (DoS) condition.
How does CVE-2022-22950 affect the Spring Framework?
CVE-2022-22950 affects Spring Framework versions 5.3.0 to 5.3.16, as well as older unsupported versions.
What is the severity of CVE-2022-22950?
CVE-2022-22950 has a severity rating of high (7 out of 10).
Which software versions are affected by CVE-2022-22950?
CVE-2022-22950 affects Spring Framework versions 5.3.0 to 5.3.16, and older unsupported versions. The issue can be remedied by updating to version 5.3.17 or later.
How can I mitigate the CVE-2022-22950 vulnerability?
To mitigate the CVE-2022-22950 vulnerability, update your Spring Framework installation to version 5.3.17 or later.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-22950
- agent/software-canonical-lookup
- collector/ibm-support
- source/IBM
- agent/weakness
- agent/references
- agent/severity
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- package-manager/redhat
- vendor/vmware
- canonical/vmware spring framework
- version/vmware spring framework/5.3.0