Database Management

DPA and remote code execution (RCE) issue: CVE-2016-1000027

This article describes CVE-2016-1000027 and explains why DPA is not affected.

First published date

8/24/2023 3:55 PM

Last published date

8/24/2023 3:55 PM

Overview

In April 2023, the National Institute of Standards and Technology (NIST) updated the following security bulletin about a potential remote code execution (RCE) issue:

CVE-2016-1000027 (© 2023 National Institute of Standards and Technology, available at nvd.nist.gov, obtained on August 18, 2023)

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur.

After conducting further research, SolarWinds confirmed that all versions of the spring-web library up to version 6.0.0 are vulnerable to CVE-2016-1000027.

Product section

Database Performance Analyzer

Cause

CVE-2016-1000027

Resolution

All supported versions of Database Performance Analyzer (DPA) include an affected version of the spring-web library. However, this vulnerability does not apply to DPA because DPA does not use the affected functionality.

Specifically, this vulnerability is reported for the HTTPInvoker functionality provided by the spring-web library. To use the HTTPInvoker functionality, an application must define the HttpInvokerServiceExporter bean. DPA does not define the HttpInvokerServiceExporter bean.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.