Spring Framework CVE-2016-1000027
Hello,
we have a request from our customer if Pega is using version CVE-2016-1000027 ([email protected]) of SpringFramework in any way?
All I found now is the following link: https://docs-previous.pega.com/security-advisory/security-advisory-spring-framework-vulnerability#:~:text=Spring%20is%20only%20used%20for,request%20mapping%20and%20parameter%20binding).
in which only the versions CVE-2022-xxx are addressed.
Thanks a lot!
Accepted Solution
Updated: 10 Jul 2023 10:11 EDT
Pegasystems Inc.
GB
@FabianM3 The CVE-2016-1000027 description is for 5.3.16:
I could not find any mention of this CVE with Pega code.
Pega 8.7 used:
These Spring Core libraries were only used in a very few places in DSM code - the rest of the platform does not use Spring.
Spring released versions 5.3.19 and 5.2.21 that also fixed the CVE-2022-22968 vulnerability in addition to the earlier vulnerabilities. More info here: https://spring.io/blog/2022/04/13/spring-framework-5-3-19-and-5-2-21-available-now
Our most recent Pega Patch already upgraded to 5.3.18 and on top of that much was refactored to remove direct spring usage. As of 8.8.1 spring-core is 5.3.20.
Also check the Resolved Issues page for 'Spring core versions updated' solutions listed there.
@FabianM3 The CVE-2016-1000027 description is for 5.3.16:
I could not find any mention of this CVE with Pega code.
Pega 8.7 used:
These Spring Core libraries were only used in a very few places in DSM code - the rest of the platform does not use Spring.
Spring released versions 5.3.19 and 5.2.21 that also fixed the CVE-2022-22968 vulnerability in addition to the earlier vulnerabilities. More info here: https://spring.io/blog/2022/04/13/spring-framework-5-3-19-and-5-2-21-available-now
Our most recent Pega Patch already upgraded to 5.3.18 and on top of that much was refactored to remove direct spring usage. As of 8.8.1 spring-core is 5.3.20.
Also check the Resolved Issues page for 'Spring core versions updated' solutions listed there.
Please also note Pega Extended Support:
