Light

Episode #866 Quiz

Spring4Shell
Date: 2022-04-12 | Length: 1.25 hrs | Episode page at twit.tv

About this episode

Spring4Shell became actively exploited, targeting Spring Framework’s DataBinder and servlet-container POST handling, including vulnerable stock sample code. Attackers deployed web shells, malware, and Mirai, while CISA added it to the Known Exploited Vulnerabilities catalog. Mitigations include patching affected Spring, VMware, Cisco products, and avoiding vulnerable JDK9+ configurations.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what was the initial attack path described by BlueHornet for the reported Nginx issue?

Question 1

According to the episode, what was the initial attack path described by BlueHornet for the reported Nginx issue?

An LDAP injection that begins the exploit chain A crafted HTTP/2 request that crashes the proxy layer A buffer overflow in the Nginx cache module A TLS downgrade that exposes cleartext credentials

Question 2: What mitigation did Nginx recommend for deployments using the LDAP reference implementation?

Question 2

What mitigation did Nginx recommend for deployments using the LDAP reference implementation?

Disable the ldapDaemon.enabled property Upgrade the LDAP protocol to a newer major version Enable mandatory TLS for all proxied logins Remove all reverse-proxy features from Nginx

Question 3: How did Microsoft describe the ring distribution used by Windows Autopatch?

Question 3

How did Microsoft describe the ring distribution used by Windows Autopatch?

Canary, preview, standard, and enterprise Alpha, beta, release, and general availability Test, first, fast, and broad Pilot, staging, production, and fallback

Question 4: What was the practical risk Steve emphasized about the event-source-polyfill protest-ware change?

Question 4

What was the practical risk Steve emphasized about the event-source-polyfill protest-ware change?

The package would exfiltrate browser cookies to the maintainer Browsers would silently disable JavaScript for Russian users The library would break EventSource support in all browsers Users would see antiwar messages and assume the website displayed them

Question 5: What detail did Steve cite from Check Point’s reporting on the Spring4Shell outbreak?

Question 5

What detail did Steve cite from Check Point’s reporting on the Spring4Shell outbreak?

Fourteen percent of attacks were stopped by default Spring settings Sixteen percent of all Maven downloads were patched within four days Thirty-seven percent of affected systems were VMware products Sixteen percent of organizations were impacted in the first four days

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.