• Spring Framework RCE (Spring4Shell): CVE-2022-22965
• Spring Framework DoS: CVE-2022-22950
• Spring Cloud RCE: CVE-2022-22963

Impact

For products with None in the Versions known to be vulnerable column, there is no impact.

For products with ** in the various columns, F5 is still researching the issue and will update this article after confirming the required information. F5 Support has no additional information about this issue.

To determine if your product and version have been evaluated for this vulnerability, refer to the Applies to (see versions) box. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases, point releases, or hotfixes that address the vulnerability, refer to the following table. For more information about security advisory versioning, refer to K51812227: Understanding security advisory versioning.

Note: After a fix is introduced for a given minor branch, that fix applies to all subsequent maintenance and point releases for that branch, and no additional fixes for that branch will be listed in the table. For example, when a fix is introduced in 14.1.2.3, the fix also applies to 14.1.2.4, and all later 14.1.x releases (14.1.3.x., 14.1.4.x). For more information, refer to K51812227: Understanding security advisory versioning. Additionally, software versions preceding those listed in the Applies to (see versions) box of this article have reached the End of Technical Support (EoTS) phase of their lifecycle and are no longer evaluated for security issues. For more information, refer to the Security hotfixes section of K4602: Overview of the F5 security vulnerability response policy.

¹F5 evaluates only software versions that have not yet reached the End of Technical Support (EoTS) phase of their lifecycle.

²The CVSSv3 score link takes you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge.

**Confirmation of vulnerability or non-vulnerability is not presently available. F5 is still researching the issue for the products indicated, and will update this article with the most current information as soon as it has been confirmed. F5 Support has no additional information on this issue.

Mitigation

F5 has published the following mitigation using BIG-IP ASM/Advanced WAF and will publish additional mitigations and details as they become available. F5 is investigating this with the highest urgency:

• K24912123: Mitigate the Spring Framework (Spring4Shell) and Spring Cloud vulnerabilities with the BIG-IP system

• K41942608: Overview of AskF5 security advisory articles
• K4602: Overview of the F5 security vulnerability response policy
• K4918: Overview of the F5 critical issue hotfix policy
• K8986: F5 software lifecycle policy
• K9970: Subscribing to email notifications regarding F5 products
• K9957: Creating a custom RSS feed to view new and updated documents