# Are any of Elastic's products affected by CVE-2022-22965?

**URL:** <https://discuss.elastic.co/t/are-any-of-elastics-products-affected-by-cve-2022-22965/301576>\
**Category:** Elastic Security\
**Created:** [April 5, 2022, 3:22am UTC](https://discuss.elastic.co/t/are-any-of-elastics-products-affected-by-cve-2022-22965/301576 "2022-04-05T03:22:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![xxgogogo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xxgogogo/32/103944_2.png) [@xxgogogo](https://discuss.elastic.co/u/xxgogogo)\
**Post date:** [April 5, 2022, 3:22am UTC](https://discuss.elastic.co/t/are-any-of-elastics-products-affected-by-cve-2022-22965/301576/1 "2022-04-05T03:22:22Z")

</div>

Hi,

- Are any of Elastic's products(Elasticsearch, Kibana, and so on) affected by CVE-2022-22965?  
Link: [https://tanzu.vmware.com/security/cve-2022-22965](https://tanzu.vmware.com/security/cve-2022-22965)

Thanks!

---

<div class="post-metadata">

**Author:** ![Ayush\_Mathur](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayush_mathur/32/77134_2.png) [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)\
**Post date:** [April 7, 2022, 6:21am UTC](https://discuss.elastic.co/t/are-any-of-elastics-products-affected-by-cve-2022-22965/301576/2 "2022-04-07T06:21:24Z")

</div>

@xxgogogo I believe the only impact would be on java client which use spring data, don't see any other vulnerability on Elastic Stack as such.

---

<div class="post-metadata">

**Author:** ![Sagarika\_Mahalik](https://avatars.discourse-cdn.com/v4/letter/s/eb8c5e/32.png) [@Sagarika\_Mahalik](https://discuss.elastic.co/u/Sagarika_Mahalik)\
**Post date:** [April 14, 2022, 4:26pm UTC](https://discuss.elastic.co/t/are-any-of-elastics-products-affected-by-cve-2022-22965/301576/3 "2022-04-14T16:26:02Z")

</div>

Hi, we use Elasticsearch-rest-client, Elasticsearch-rest-high-level-client and spring data too. Will ES affect by the Spring4Shell ::Spring Framework Remote Code Execution Vulnerability?

---

<div class="post-metadata">

**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\
**Post date:** [April 15, 2022, 2:08pm UTC](https://discuss.elastic.co/t/are-any-of-elastics-products-affected-by-cve-2022-22965/301576/4 "2022-04-15T14:08:52Z")

</div>

Hi, @xxgogogo. So far, the Elastic team has not released notes regarding this vulnerability in their products. However, as good security practices, it is interesting to mitigate the risk of exploiting this type of attack by applying correction patches available in other applications based on the framework as they can be an attack vector to your environment.

Here are some links with recommendations for mitigating the failure:

- [Spring Framework RCE, Early Announcement](https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement)
- [Red Hat Customer Portal - Access to 24x7 support and knowledge](https://access.redhat.com/security/cve/CVE-2022-22965)
- [DCX](https://success.trendmicro.com/dcx/s/solution/000290773?language=en_US)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2022, 2:09pm UTC](https://discuss.elastic.co/t/are-any-of-elastics-products-affected-by-cve-2022-22965/301576/5 "2022-05-13T14:09:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.