TIBCO is aware of the recently announced Java Spring Framework vulnerabilities (CVE-2022-22963, CVE-2022-22965), with one of them being referred to as “Spring4Shell”.

These vulnerabilities potentially enable an attacker to execute arbitrary code by taking advantage of poor data bindings and/or malicious expression language statements. 

TIBCO is actively monitoring the still evolving situation and updates with regards to the Java Spring Framework and our Product Security Incident Response Team (PSIRT) is actively evaluating how this vulnerability may affect TIBCO products and cloud services.

TIBCO continues to make the investigation and remediation of this vulnerability its top priority. We will provide updates for the TIBCO Patterns-Search via this article if more information becomes available. Please contact TIBCO Support with any questions. 

Instructions for patching the Spring™ Framework in TIBCO Patterns-Search 5.5 and 5.6

  Prerequisites

1. Download spring-5.2.20.RELEASE-dist.zip(https://repo.spring.io/ui/native/release/org/springframework/spring/5.2.20.RELEASE/spring-5.2.20.RELEASE-dist.zip) to TIBCO_HOME/tps/5.x/patterns_gui/
2. Unzip it. Locate the libs sub-folder, which should contain several .jar files

Steps :

             Windows: bin/pws.bat -stopTomcat

             Linux: bin\pws.sh –stopTomcat

Use your organization’s approved backup methods, or simply make a copy of the entire Tomcat folder.

From TIBCO_HOME/tps/5.x/patterns_gui/tomcat/webapps/patterns/WEB-INF/lib, remove these ten (10) files

spring-aop-5.2.0.RELEASE.jar

spring-beans-5.2.0.RELEASE.jar

spring-context-5.2.0.RELEASE.jar

spring-core-5.2.0.RELEASE.jar

spring-expression-5.2.0.RELEASE.jar

spring-jcl-5.2.0.RELEASE.jar

spring-jdbc-5.2.0.RELEASE.jar

spring-test-5.2.0.RELEASE.jar

spring-web-5.2.0.RELEASE.jar

spring-webmvc-5.2.0.RELEASE.jar

From TIBCO_HOME/tps/5.x/patterns_gui/tomcat/webapps/pws/WEB-INF/lib, remove these nine (9) files

spring-aop-5.2.0.RELEASE.jar

spring-beans-5.2.0.RELEASE.jar

spring-context-5.2.0.RELEASE.jar

spring-core-5.2.0.RELEASE.jar

spring-expression-5.2.0.RELEASE.jar

spring-jcl-5.2.0.RELEASE.jar

spring-oxm-5.2.0.RELEASE.jar

spring-web-5.2.0.RELEASE.jar

spring-webmvc-5.2.0.RELEASE.jar

 Change the directory into the libs subfolder of the unzipped directory (see the prerequisites).

 Copy these ten (10) jars to TIBCO_HOME/tps/5.x/patterns_gui/tomcat/webapps/patterns/WEB-INF/libs

spring-aop-5.2.20.RELEASE.jar

spring-beans-5.2.20.RELEASE.jar

spring-context-5.2.20.RELEASE.jar

spring-core-5.2.20.RELEASE.jar

spring-expression-5.2.20.RELEASE.jar

spring-jcl-5.2.20.RELEASE.jar

spring-jdbc-5.2.20.RELEASE.jar

spring-test-5.2.20.RELEASE.jar

spring-web-5.2.20.RELEASE.jar

spring-webmvc-5.2.20.RELEASE.jar

Copy these nine (9) jars to TIBCO_HOME/tps/5.x/patterns_gui/tomcat/webapps/pws/WEB-INF/libs

spring-aop-5.2.20.RELEASE.jar

spring-beans-5.2.20.RELEASE.jar

spring-context-5.2.20.RELEASE.jar

spring-core-5.2.20.RELEASE.jar

spring-expression-5.2.20.RELEASE.jar

spring-jcl-5.2.20.RELEASE.jar

spring-oxm-5.2.20.RELEASE.jar

spring-web-5.2.20.RELEASE.jar

spring-webmvc-5.2.20.RELEASE.jar

5. Restart the Tomcat service

On the command line, change directory to TIBCO_HOME/tps/5.x/patterns_gui

Windows: bin/pws.bat -startTomcat

Linux: bin\pws.sh –startTomcat

Uninstalling the patch

The patch can be uninstalled as follows:

1. Stop the Tomcat server
2. Remove the 5.2.20 jar files
3. Restore the 5.2.0 jar files 
4. Start the Tomcat server

TIBCO's Spring Framework Vulnerability Update

• https://www.tibco.com/support/notices/spring-framework-vulnerability-update