Nexus Documentation
CURL vulnerability information (CVE-2023-38545) - Nexus awareness advisory on Microsoft's update KB5014754

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 4 Next »

General information

This article contains information related to the remote code execution (RCE) vulnerability affecting Spring, CVE-2022-22965 and CVE-2022-22963.
These CVEs were reported on the 31/3 and Nexus security team has been investigating this closely since they became official.

The Spring Framework provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform.

Official sites for the CVEs:

https://tanzu.vmware.com/security/cve-2022-22965
https://tanzu.vmware.com/security/cve-2022-22963

The Nexus Security team is investigating the impact of the Spring related CVEs (CVE-2022-22963 and CVE-2022-22965), and the possible impact on our components.

Mitigation

Nexus development teams are investigating the best ways of mitigating the vulnerabilities.
Current investigations provide no means of workaround, other than to provide a workaround with corrections in the code.

Nexus components

This list contains the components from Nexus, and their respective affected versions.

Component

Affected versions CVE-2022-22965

Affected versions CVE-2022-22963

Comment

Smart ID Certificate Manager

Not affectedNot affectedDoes not use Spring

Nexus OCSP Responder

Not affectedNot affectedDoes not use Spring

Nexus Timestamp Server

Not affectedNot affectedDoes not use Spring

Smart ID Desktop App/Client

Not affectedNot affectedDoes not use Spring
Smart ID Mobile AppNot affectedNot affectedDoes not use Spring

Nexus Card SDK

Not affectedNot affectedDoes not use Spring

Smart ID Physical Access

Not affectedNot affectedDoes not use Spring

Smart ID Digital Access (previously named Hybrid Access Gateway – HAG)

Not affectedNot affectedDoes not use Spring

Smart ID Identity Manager/PRIME

Any version running on JRE 11.

Smart ID version 20.11 and above requires JRE 11, thus they are affected.

For PRIME version 3.12 and below, they are affected only if you choose to run them with JRE 11 instead of JRE 8.

Not affected
(does not use spring-cloud-functions)		Further investigations ongoing.

Patch implementation and mitigation in planning

Smart ID Self-Service (Angular/SpringBoot-based)

Any version running on JRE 11.

Smart ID version 20.11 and above requires JRE 11, thus they are affected.

For older versions, they are affected only if you choose to run them with JRE 11 instead of JRE 8.



Not affected
(does not use spring-cloud-functions)		Further investigations ongoing.

Patch implementation and mitigation in planning
Smart ID Self-Service Legacy USSP (Wicket-based)

Any version running on JRE 11.

Smart ID version 20.11 and above requires JRE 11, thus they are affected.

For older versions, they are affected only if you choose to run them with JRE 11 instead of JRE 8.

Not affected

(does not use spring-cloud-functions)

Further investigations ongoing.

Patch implementation and mitigation in planning

Smart ID Messaging component - Hermod

In Hermod 3.3.3 Spring Boot has been updated to ensure that no version is affected by the Spring4Shell vulnerability.Not affected

Recommendation from Nexus is for you as a customer to verify if you have deployed a plain WAR file in tomcat.

Nexus ID06 ServiceNot affectedNot affectedServices patched
Nexus Go CardsNot affectedNot affectedServices patched

Latest update date of this article

2022-04-04


Table of contents

  • No labels

Copyright 2024 Technology Nexus Secured Business Solutions AB. All rights reserved.
Contact Nexus | https://www.nexusgroup.com | Disclaimer | Terms & Conditions