Question

Is Rosetta affected by Spring4Shell vulnerability in the Spring Framework?

Answer

CVE-2022-22965 – Rosetta is not vulnerable since it doesn’t use Spring MVC. 
The vulnerable jar can be removed from Rosetta version 7.2 and below application servers:

rm /exlibris/dps/d4_1/system.dir/thirdparty/tomcat/lib/spring-webmvc.jar

CVE-2022-22963 - Rosetta is not vulnerable since it doesn’t use the Spring Cloud Function. 

• Article last edited: 05-APR-2022