On Thursday 31 March 2022 VMWare published CVE-2022-22965 describing a vulnerability in Spring. Since that time we have had a number of customers contacting our Support Team to ask if Chocolatey products are vulnerable.
VMWare provide Spring, a very popular Java based library for more quickly developing Java-based applications. The CVE VMWare published identified an issue in the Spring MVC and Spring WebFlux features of versions 5.3.0 to 5.3.17 and 5.2.0 to 5.2.19, while older, unsupported versions of Spring are also affected.
Are Chocolatey Products Affected?
Chocolatey products do not run on, or use, Java and do not use the Spring library. The Chocolatey For Business products below are therefore NOT vulnerable:
- Chocolatey CLI
- Chocolatey Licensed Extension
- Chocolatey Agent
- Chocolatey GUI
- Chocolatey GUI Licensed Extension
- Chocolatey Central Management
While we call out the above Chocolatey For Business products specifically, no Chocolatey products, business or open-source, use the Spring library and are therefore NOT vulnerable.
Chocolatey For Business Quick Deployment Environment (QDE)
Our Quick Deployment Environment enables customers to get up and running with Chocolatey For Business in as little as 20 minutes. We provide this in Azure and also as a Quick Start Guide. In the past we have also provided this as a virtual machine image that you can import into your hypervisor of choice.
Whatever flavour of QDE you have, it has three components which we have confirmed are NOT vulnerable.
Sonatype Nexus Repository OSS
Sonatype have confirmed that Nexus uses the logback logging library and not Spring and is therefore not vulnerable. Sonatype provides more information on it’s website.
Jenkins
The Jenkins team have confirmed that Jenkins Core does not use the Spring library and they provide more information on their website.
Chocolatey Central Management
As confirmed above, Chocolatey Central Management does not run on, or use, Java and is therefore NOT vulnerable.
Other Products
The most common repository managers used with Chocolatey are Sonatype Nexus and JFrog Artifactory and we recommend both of those products to customers. While we have confirmed that Sonatype Nexus is not vulnerable above, we wanted to confirm JFrog Artifactory is also NOT vulnerable.
We hope this post answers your question as to whether Chocolatey products are vulnerable. However, if you are a Chocolatey For Business customer and have more questions, please reach out to our Support Team as normal. You can find out your options on how to do so by running choco support
from the command line.
Written By:
Chocolatey Team
Chocolatey Software enriches lives by empowering technologists with powerful and flexible yet simple solutions that automate the complexities of software deployment, configuration, and management.
Share On
Posted In
Popular Tags
- #news 70 Number of post with tag news
- #press release 57 Number of post with tag press release
- #chocolatey for business 44 Number of post with tag chocolatey for business
- #packaging 21 Number of post with tag packaging
- #open source 17 Number of post with tag open source
- #community 15 Number of post with tag community
- #tutorial 14 Number of post with tag tutorial
- #12 days of Chocolatey 2023 12 Number of post with tag 12 days of Chocolatey 2023
- #chocolatey community repository 12 Number of post with tag chocolatey community repository
- #podcast 11 Number of post with tag podcast