CVE report published for Spring Cloud Function

We have released Spring Cloud Function 3.2.6 to address the following CVE report. CVE-2202-22979: Spring Cloud Function Dos Vulnerability Please review the information in the CVE report and upgrade immediately...

Spring Cloud Function Dos Vulnerability

In Spring Cloud Function versions 3.2.5 and older unsupported versions, it is possible for a user who directly interacts with framework provided lookup functionality to cause denial of service condition due to the caching issue in Function Catalog component of the framework. At the time of writin...

This Week in Spring - May 17th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! I am in beautiful Barcelona, Spain, this week, ahead of the upcoming Spring I/O show. I just spent a wonderful week in amazing England, meeting old friends, speaking at Devoxx UK, etc. A Bootiful Podcast: EasyMock contributor...

Exploit for Code Injection in Vmware Spring_Cloud_Function

Spring Cloud Function SpEL Expression Injection Vulnerability...

VMware Spring Cloud Function < 3.1.7 / 3.2.x < 3.2.3 SPEL Expression Injection (local check)

The version of Spring Cloud Function running on the remote host is affected by a remote code execution vulnerability in the routing functionality. A remote, unauthenticated attacker could provide a specially crafted SpEL as a routing expression that may result in remote code execution on the remo...

spring-cloud-function: Remote code execution by malicious Spring Expression

A flaw was found in Spring Cloud Function via the spring.cloud.function.routing-expression header that is modified by the attacker to contain malicious expression language code. The attacker is able to call functions that should not normally be accessible, including runtime exec calls...

Spring Cloud Function Remote Code Execution

Added: 04/05/2022 Background Spring Cloud Function abstracts all transport details and infrastructure, allowing developers to keep all familiar tools and processes and focus on business logic. Problem Spring Cloud Function has remote code execution vulnerability. An attacker could provide a craft...

Spring Cloud Function Remote Code Execution

Added: 04/05/2022 Background Spring Cloud Function abstracts all transport details and infrastructure, allowing developers to keep all familiar tools and processes and focus on business logic. Problem Spring Cloud Function has remote code execution vulnerability. An attacker could provide a craft...

BSA-2022-1768

Security Advisory ID : BSA-2022-1768 Component : Spring Cloud Revision : 1.0 In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in...

GHSA-6V73-FGF6-W5J7 Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...

ai.hyacinth.framework:core-service-bus-support (0.5.24), cc.vihackerframework:vihacker-kafka-starter (>=1.0.4.r, <=1.0.6.r) +504 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.0.0.release, <=3.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.0.0.release, =1.0.4.r, =1.0.6.r - ch.voulgarakis:spring-cloud-stream-binder-jms 1.0.0.release - city.smartb.f2:f2-spring-boot-starter-function 0.1.0 - city.smartb.f2:f2-spring-boot-starter-function-http 0.1.0 -...

com.fnproject.fn:fn-spring-cloud-function (>=1.0.70, <=1.0.109), org.springframework.cloud:spring-cloud-function-adapter-aws (1.0.0.release) +7 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (1.0.0.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: - com.fnproject.fn:fn-spring-cloud-function...

ai.hyacinth.framework:core-service-bus-support (0.5.24), cc.vihackerframework:vihacker-kafka-starter (>=1.0.4.r, <=1.0.6.r) +504 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.0.0.release, <=3.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.0.0.release, =1.0.4.r, =1.0.6.r - ch.voulgarakis:spring-cloud-stream-binder-jms 1.0.0.release - city.smartb.f2:f2-spring-boot-starter-function 0.1.0 - city.smartb.f2:f2-spring-boot-starter-function-http 0.1.0 -...

city.smartb.f2:f2-spring-boot-starter-function (>=0.2.2, <=0.6.0), city.smartb.f2:f2-spring-boot-starter-function-http (>=0.2.2, <=0.6.0) +338 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.2.0, <=3.2.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.6.0 and more Source cves: CVE-2022-22963 Source advisory: OSV:GHSA-6V73-FGF6-W5J7...

org.springframework.cloud:spring-cloud-function-adapter-aws (1.0.1.release), org.springframework.cloud:spring-cloud-function-adapter-azure (1.0.1.release) +6 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (1.0.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

org.springframework.cloud:spring-cloud-function-adapter-aws (1.0.2.release), org.springframework.cloud:spring-cloud-function-adapter-azure (1.0.2.release) +6 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (1.0.2.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

com.alipay.sofa:sofa-boot-autoconfigure (>=3.16.2, <=3.25.0), com.alipay.sofa:tracer-sofa-boot-starter (>=3.1.0, <=3.1.2) +378 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.0.0.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: - com.alipay.sofa:sofa-boot-autoconfigure...

ai.hyacinth.framework:core-service-bus-support (0.5.0), com.alibaba.cloud:spring-cloud-starter-bus-rocketmq (>=2.1.0.release, <=2.1.4.release) +138 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.0.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

ai.hyacinth.framework:core-service-bus-support (>=0.5.2, <=0.5.21), cn.springcloud.gray:spring-cloud-gray-plugin-event-stream (>=c.0.0.1, <=c.0.0.5) +375 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.0.2.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

com.solace.spring.cloud:spring-cloud-starter-stream-solace (>=1.2.0, <=1.2.1), com.solace.spring.cloud:spring-cloud-stream-binder-solace (>=1.2.0, <=1.2.1) +43 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.1.0.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...