Spring4Shell & Lansweeper

[ErikT]

Recently a new vulnerability in the Java Spring framework dubbed Spring4Shell. CVE-2022-22965 has a potentially large impact as many applications use the Spring framework.

Neither Lansweeper, nor its 3rd party components are vulnerable or affected.

Read more in our Spring4Shell blogpost

[Guest]

Regardless of the above we are being told to upgrade SPRING but do not have any instructions.
Our license is up for renewal and IT Security team have made this a condition before they will approve renewal.

Please advise how this can be done

[ukaussiSMS]

Guest wrote:
Regardless of the above we are being told to upgrade SPRING but do not have any instructions.
Our license is up for renewal and IT Security team have made this a condition before they will approve renewal.

Please advise how this can be done

This questions was from myself BTW, was not logged in
It is URGENT and we are having to shutdown server today until resolved

[FrankSc]

Hi,
With the blogpost, we confirmed that Lansweeper on its own, or its 3rd part components, are not affected by this vulnerability.
Upgrading affected applications, depends on the applications that you are running, which are possibly affected by this. The library can be used in different applications.

To mitigate the issue, we found the following link:
https://www.contrastsecurity.com/security-influencers/new-spring4shell-vulnerability-confirmed-what-it-is-and-how-to-be-prepared

[ukaussiSMS]

FrankSc wrote:
Hi,
With the blogpost, we confirmed that Lansweeper on its own, or its 3rd part components, are not affected by this vulnerability.
Upgrading affected applications, depends on the applications that you are running, which are possibly affected by this. The library can be used in different applications.

To mitigate the issue, we found the following link:
https://www.contrastsecurity.com/security-influencers/new-spring4shell-vulnerability-confirmed-what-it-is-and-how-to-be-prepared

As this is a simple W10 Enterprise desktop PC whose sole task is running Lansweeper for 4000 assets I will have to wait for what our Security team says as know nothing of Java, Spring or programming.