Spring4Shell Risk Mitigation

ThreadFix Spring4Shell Vulnerability Response

The National Vulnerability Database has identified a high risk exploit, Spring4Shell, which affects applications running Tomcat as a WAR deployment. For more information refer to CVE-2022-22965. In response Coalfire has tested ThreadFix to assess risk and mitigation options. Users should update their version of Tomcat to the latest version in addition to upgrading to ThreadFix version 2.8.6 which further mitigates risk of exposure and provides an additional security enhancement. At a minimum, ThreadFix recommends all users update their version of Tomcat to version 8.5.78 to safeguard against exposure.

Tomcat Update and Migration Guides

• https://tomcat.apache.org/migration-85.html#Upgrading_8.5.x

• https://tomcat.apache.org/migration.html

April 2022 Update

ThreadFix version 2.8.6 addresses the Spring4Shell vulnerability, note the download file and release notes below:

• ThreadFix 2.8.6 Download Release

• 2.X Release Notes

If you have any questions or concerns please reach out to our support team at support@threadfix.it.