Submit Feedback
Legacy Knowledge Base
Published Jul. 2, 2025

Version of spring-** jars after installing a hotfix

Written By

Kanchan Bisht

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

  • To address the Spring4Shell vulnerabilities, the patched version of spring-beans.jar should be in its manifest file after the hotfix installation, is spring-webmvc.jar included in this?

Environment

  • Liferay DXP 7.2

Resolution

  • Only the spring-beans.jar is patched by the Liferay patch for DXP 7.2, 7.1, and 7.0. 

  • To address this vulnerability, Spring released new versions of the 5.3.x and 5.2.x libraries. As DXP 7.4 and 7.3 use the 5.2.x library, all of the jars were updated to the latest version to prevent the vulnerability and minimize any potential issues that could arise if various versions of Spring jars were used.

  • DXP 7.2 and earlier, on the other hand, uses Spring 4.3.x or Spring 3.0.x. These versions were patched in order to mitigate the vulnerability.

  • Here is the code change to mitigate this vulnerability which Spring wrote and committed to the Spring repository. Only one file in the spring-beans.jar is changed by this code update. As a result, the patch for versions 4.3.x and 3.0.x will only change one Spring jar: spring-bean.jar. Other Liferay files were modified in order to adapt to these changes.

Additional Information

  • [LPS-150754] Update spring to 5.2.20
  • Verify for a hotfix for the Spring4Shell vulnerability: open the {liferay_home}/tomcat/webapps/ROOT/WEB-INF/lib/spring-beans.jar, it should have the patched version in its manifest file
Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?