EVS security updates on Spring4Shell vulnerability

Updated 24 May 2022 - 12:00 CET

Introduction

EVS is actively responding to the reported vulnerability in the Spring MVC or Spring WebFlux application dubbed Spring4Shell. We are currently conducting a product-by-product analysis to determine if any are potentially impacted by the vulnerability. This is an ongoing investigation, so please check this bulletin page frequently for updates.

Description

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Products under investigation or not impacted

Product Version Status Comment
CCast All Not affected  
Cerebrum All Not affected  
Dyvi All Not affected  
Ingest Funnel All Not affected  
IPDirector All Not affected The service runs under Java 8 and not under Tomcat (under these conditions there is no vulnerability).
IPD-VIA All Not affected  
IPLink for Adobe All Not affected  
IPLink for Avid All Not affected  
IPWeb All Not affected  
LSM Connect All Not affected  
LSM-VIA All Not affected  
MAD All Not affected  
Mediahub All  Under analysis  
Multicam (XT) All Not affected  
MultiReview All Not affected  
Neuron All Not affected  
PMZ All Not affected  
Synapse All Not affected  
Teradici Cloud Access All Not affected  
Truck Manager All Not affected  
XFile All Not affected  
XnetMonitor All Not affected  
XnetWebMonitor All Not affected  
Xplore All Not affected  
Xsquare All Not affected  
Xstore All Not affected  
Xedio All Not affected  

 

Known EVS impacted products & resolution

This list is under investigation and will be regularly updated.

Product Version Status Workaround Patch
XS-Neo / X-One / Xeebra All Impacted Update to Spring Framework 5.3.18 and 5.2.20 or greater. Important note: internal library, not used by any exposed services. Requires having ssh access to the system.   

More information

More information and detailed explanations on the working of this vulnerability can be found via the links below: