eDelivery sample software affected by Remote Code Execution vulnerability reported in Spring Framework

...

Image Added

Update 04/04/2022

Patches for all product lines that are under active support are now available:

• Domibus 4.2.9 was released on Monday, 4 April 2022
• SMP 4.1.2 was released on Monday, 4 April 2022
• BDMSL 4.1.1 was released on Monday, 4 April 2022

Original announcement

A vulnerability allowing Remote Code Execution was reported by the Spring Framework project on 31 March 2022. Please refer to the early announcement for details.

...

The eDelivery Building Block

eDelivery is a building block that provides technical specifications and standards, installable software and ancillary services to allow projects to create a network of nodes for secure digital data exchange.

Domibus is the sample software provided by the European Commission to implement an eDelivery AS4 Access Point for the interoperable, secure and reliable exchange of data. It is based on the eDelivery AS4 profile, an open technical specification for the secure, web-based, payload-agnostic exchange of data or documents.

SMP is the sample software provided by the European Commission to implement an eDelivery Service Metadata Publisher (SMP) for publishing and retrieving data necessary for an eDelivery party to dynamically configure its system for message exchange with counterparties using eDelivery. It is based on the eDelivery SMP profile, an open technical specification for publishing service metadata within a 4-corner network.

BDMSL is the sample software provided by the European Commission to implement an eDelivery Service Metadata Locator (SML) for an eDelivery party to discover the URLs of other counterparties using eDelivery Access Points and their corresponding metadata. It is based on the eDelivery BDXL profile, an open technical specification for locating Access Points within a network.