CVE-2023-39106

creationtimestamp| type| source ---|---|--- 2023-08-21 20:41:08+00:00| seen| https://t.me/cibsecurity/68893...

cc.ereach:ereach-boot-starter-dubbo (1.0.1), cc.ereach:ereach-boot-starter-env (1.0.1) +30 more potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (>=1.1.0, <=1.1.1)

com.alibaba.nacos:nacos-spring-context MAVEN version =1.1.0, =3.0.9, =3.0.1, =3.0.1, =3.0.1, =0.1.8, =0.1.8, =0.1.10, =0.1.10, =0.1.10, =0.1.10, =5.3.0, =6.0 - com.niezhiliang:nacos-config-refresh-spring-boot-starter 0.1.1 and more Source cves: CVE-2023-39106 Source advisory: GHSA-V6C8-PWHQ-288M...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.0, <=0.2.0), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.0, <=0.2.0) potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.1.0-rc1)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.1.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.0, =0.1.0, =0.2.0 Source...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.2, <=0.2.2), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.2, <=0.2.2) potentially affected by CVE-2023-39106 via com.alibaba.nacos:nacos-spring-context (0.3.1)

com.alibaba.nacos:nacos-spring-context MAVEN version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-spring-context and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.2, =0.1.2, =0.2.2 Source cve...

CVE-2023-39106

CVE-2023-39106 concerns the Nacos Spring Project (v1.1.1 and earlier). The issue arises in the SnakeYamls Constructor(), used to parse YAML files, allowing a remote attacker to execute arbitrary code. The vulnerability is described consistently across multiple sources in the provided documents (N...