Indeni’s response to Spring4Shell 

Spring4Shell, tracked as CVE-2022-22965, is a remote code execution vulnerability published March 29, 2022 that affects Spring Core when running on Java Development Kit versions 9 and above. Remote code execution vulnerabilities are critical because they can allow attackers to run arbitrary code on affected servers, potentially compromising data, availability, and integrity of systems in production. The vulnerability was later upgraded to critical severity, prompting immediate examination by engineering and security teams to determine product exposure and mitigation steps.

Following the disclosure and the critical severity upgrade, Indeni’s engineering team was immediately engaged to assess exposure and confirmed that Indeni is not vulnerable to Spring4Shell. The determination was based on product technical characteristics: Indeni does not use JDK 9 (or later) and does not use the Spring Framework, both conditions required for the vulnerability to be exploitable. As a result, no remediation for Indeni was required in response to this specific issue.

The article indicates that readers with additional questions related to Spring4Shell are invited to contact the team, implying that Indeni or its engineering/security contacts are available to provide further clarification. For specific follow-up, reach out to your usual Indeni support or engineering contact channels to request details about the assessment, timelines, or any related security guidance. The engineering team engaged immediately upon disclosure and can provide authoritative answers about product exposure and mitigations.