Hi shinyproxy community
it might be early days, but thought i would start the conversation about whether shinyproxy is affected by this new vulnerability. Here's a link to a blog post by spring.io:
https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
Here's my assessment:
shinyproxy 2.6.0 is running spring-boot version 2.3.4 which is affected by the vulnerability, but we are executing as a JAR file not using tomcat. So while the vulnerability is present, the environment in which the app is executed is still considered safe based on the current knowledge (dated april 1, 2022)
Is that a fair statement?
Hi shinyproxy community
it might be early days, but thought i would start the conversation about whether shinyproxy is affected by this new vulnerability. Here's a link to a blog post by spring.io:
https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
Here's my assessment:
shinyproxy 2.6.0 is running spring-boot version 2.3.4 which is affected by the vulnerability, but we are executing as a JAR file not using tomcat. So while the vulnerability is present, the environment in which the app is executed is still considered safe based on the current knowledge (dated april 1, 2022)
Is that a fair statement?