Hi!
Today, a RCE 0-day vulnerability was discovered in SpringShell:
https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html
It seems like Jamf is using the Spring framework
/usr/local/jss/tomcat/webapps/ROOT/WEB-INF/lib/spring-beans-5.3.9.jar
Is Jamf Pro affected by this vulnerability and if so, what is the recommended action?
We are actively investigating this reported vulnerability. Though Jamf Pro does utilize the Spring Framework, we have not found any evidence that Jamf customers are affected in any way at this time.
Aaron Kiemele
Jamf, CISO
Please review @Aaron_Kiemele more detailed post regarding this question.
The same question like @CrawfordRobson In Jamf Pro installation folder I see file : spring-beans-5.3.11.jar. In reference to the article : https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html?m=1 . It determine that application is potentiality vulnerability for spring4shell ... ?
@CrawfordRobson Thanks for reposting your question on this thread.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.