Is the Spring4Shell vulnerability email from Shopify Partners legitimate?

Shopify Discussion
1

I received an email from “Shopify Partners partners@email.shopify.com” which advises me ;-

“On March 29th, we became aware of the Spring4Shell vulnerability through our proactive security monitoring, and immediately investigated any potential risk to our systems. This vulnerability affects the common programming libraries “Spring Framework and Spring Boot” and can be exploited to achieve remote code execution.”

It then asks me to upload a mitigation patch.

Is this a genuine email?? I have never had to upload an update or patch so I’m concerned it is fraudulent. All the links show “www.click.email.shopify.com”

I’ve never heard of Spring4Shell before either.

Thanks.

2

Hi @Clodbuster it’s highly recommended that you contact Shopify support as soon as possible to clarify the mentioned email and problem. You can contact them via multiple options https://help.shopify.com/en in case it’s a fraudulent email, Shopify will have their ways to warn merchants. Hope this helps!

3

Have you got any solution?
I am also getting the same mail from Shopify Partners.
My app is created in laravel framework. Is this affected in my app?