04-01-2022 06:13 AM
04-01-2022 06:22 AM
We're still evaluating the impact of this vulnerability in the ACS Stack.
It's highly unlikely that vanilla Alfresco deployment is vulnerable to this CVE, but we'll be publishing an official statement related to this topic in the next days.
04-01-2022 06:36 AM
Thank you for the quick reply. We'll be waiting for the official statement.
04-04-2022 07:59 AM
The Spring Frameworks vulnerabilities CVE-2022-22963 and CVE-2022-22965 requires special preconditions
(see https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement)
to be exploited. To my current knowledge, a class loading mechanism in Tomcat Common Logging allows the exploitation of this "Spring4Shell" vulnerability in the first place.
Until Alfresco has evaluated
New Tomcat versions are now available for download:
Tomcat 9 (for ACS 7.0-ACS7.2):
https://dlcdn.apache.org/tomcat/tomcat-9/v9.0.62/bin/apache-tomcat-9.0.62.tar.gz
Tomcat 8 (for ACS 6.0-ACS6.2):
https://dlcdn.apache.org/tomcat/tomcat-8/v8.5.78/bin/apache-tomcat-8.5.78.tar.gz
With Apache Tomcat versions 10.0.20, 9.0.62 and 8.5.78, the WebappClassLoaderBase.getResources() method has been disabled. This prevents attacks via Spring4Shell vulnerability and as far as I know secures Alfresco Content Services against this exploit.
More information:Explore our Alfresco products with the links below. Use labels to filter content by product module.