Hello,
we have a request from our customer if Pega is using version CVE-2016-1000027 ([email protected]) of SpringFramework in any way?
All I found now is the following link: Pegasystems Documentation).
in which only the versions CVE-2022-xxx are addressed.
Thanks a lot!
@FabianM3 The CVE-2016-1000027 description is for 5.3.16:
I could not find any mention of this CVE with Pega code.
Pega 8.7 used:
These Spring Core libraries were only used in a very few places in DSM code - the rest of the platform does not use Spring.
Spring released versions 5.3.19 and 5.2.21 that also fixed the CVE-2022-22968 vulnerability in addition to the earlier vulnerabilities. More info here: https://spring.io/blog/2022/04/13/spring-framework-5-3-19-and-5-2-21-available-now
Our most recent Pega Patch already upgraded to 5.3.18 and on top of that much was refactored to remove direct spring usage. As of 8.8.1 spring-core is 5.3.20.
Also check the Resolved Issues page for ‘Spring core versions updated’ solutions listed there.
Please also note Pega Extended Support:
