Developer tool now available for use on GitHub
TEL AVIV AND BOSTON – April 1, 2022 – WhiteSource, a leader in application security, today launched WhiteSource Spring4Shell Detect, a free command-line interface (CLI) tool that quickly scans projects to find vulnerable open source libraries for CVE-2022-22965, also known as Spring4Shell.
Spring4Shell is a remote code execution (RCE) vulnerability in Spring, one of the most popular open-source frameworks for Java applications in use today. While we are still learning about this vulnerability, its impact is likely on par with that of Log4j and it is considered extremely critical with a severity score of 9.8. WhiteSource’s free developer tool, which is available now on GitHub, provides developers with the exact path to direct and indirect dependencies, along with the fixed version, for speedy remediation.
“Organizations and security teams must approach Spring4Shell with the same attention and urgency they did with the recent Log4j vulnerability,” said Rami Sass, CEO, WhiteSource. “This vulnerability highlights the importance of a proactive approach to software security and the need for more automated application security to be baked into the development lifecycle. Ensure you are handling your technical debt, and update.”
Given the potential widespread impact and risk of this zero-day vulnerability, WhiteSource recommends organizations take the following steps to address and prevent similar instances in the future:
WhiteSource Renovate, which has more than one hundred million downloads, automatically updates dependencies and has already identified and mitigated the Spring4Shell vulnerability for tens of thousands of enterprises around the world.
More information on the Spring4Shell vulnerability can be found on WhiteSource’s blog: Spring4Shell Zero-Day Vulnerability: Information and Remediation for CVE-2022-22965.