SpringFramework 0-day

[Dave_Pisarek]

Do we know if ASM is able to protect against this SpringFramework 0-day cve?

https://thehackernews.com/2022/03/unpatched-java-spring-framework-0-day.html

[F5LUX]

more infos coming soon:
https://support.f5.com/csp/article/K11510688

[buulam]

WAF signatures have now been released: https://support.f5.com/csp/article/K24912123

[Ismael_Goncalves]

I put together a Python script that enforces (remove from staging) the signatures ID explicited listed in the article K24912123. I hope it helps:
https://github.com/irgoncalves/f5-waf-enforce-sig-Spring4Shell