Spring4Shell ::Spring Framework Remote Code Execution Vulnerability

Elastic Stack Elasticsearch
1

Hello,

We are using Elasticsearch 7.16.3 and Elasticsearch 7.15.1.

  1. Can you let us know which java version both the Elasticsearch versions are using?

  2. Please let us know, whether ES is affected any way by the reported spring shell vulnerability.

Please suggest, whether we need to take any steps from our end for mitigating the same

2
  1. It's printed in the logs
  2. No.
3
  1. whether ES is affected any way by the reported spring shell vulnerability:
    Can I get an explanation for that why it is not affected?
4

I checked the java version we are using for ES 7.16.3 is Java 17. Also, we use Elasticsearch-rest-client, Elasticsearch-rest-high-level-client and spring data too. Will these affected by the Spring4Shell ::Spring Framework Remote Code Execution Vulnerability?

5

Elasticsearch does not use Spring. So it can't be affected by it.

If you are using Spring, then, that's another story but this is something you should check on the Spring forums IMO.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.