CVE-2022-22965

Name	CVE-2022-22965
Description	A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libspring-java (PTS)	jessie, jessie (lts)	3.0.6.RELEASE-17+deb8u2	vulnerable
	stretch (security), stretch (lts), stretch	4.3.5-1+deb9u1	vulnerable
	buster	4.3.22-4	vulnerable
	bullseye	4.3.30-1	vulnerable
	sid, trixie, bookworm	4.3.30-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libspring-java	source	(unstable)	(unfixed)	unimportant

Notes

https://bugalert.org/content/notices/2022-03-30-spring.html
https://tanzu.vmware.com/security/cve-2022-22965
Only supported for building applications shipped in Debian, see README.Debian.security