org.springframework.cloud:spring-cloud-function-adapter-aws (1.0.2.release), org.springframework.cloud:spring-cloud-function-adapter-azure (1.0.2.release) +6 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (1.0.2.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 1.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

ai.hyacinth.framework:core-service-bus-support (0.5.24), cc.vihackerframework:vihacker-kafka-starter (>=1.0.4.r, <=1.0.6.r) +504 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.0.0.release, <=3.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.0.0.release, =1.0.4.r, =1.0.6.r - ch.voulgarakis:spring-cloud-stream-binder-jms 1.0.0.release - city.smartb.f2:f2-spring-boot-starter-function 0.1.0 - city.smartb.f2:f2-spring-boot-starter-function-http 0.1.0 -...

city.smartb.f2:f2-spring-boot-starter-function (>=0.2.2, <=0.6.0), city.smartb.f2:f2-spring-boot-starter-function-http (>=0.2.2, <=0.6.0) +338 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.2.0, <=3.2.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.6.0 and more Source cves: CVE-2022-22963 Source advisory: OSV:GHSA-6V73-FGF6-W5J7...

city.smartb.f2:f2-spring-boot-starter-function (>=0.2.2, <=0.6.0), city.smartb.f2:f2-spring-boot-starter-function-http (>=0.2.2, <=0.6.0) +338 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.2.0, <=3.2.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.6.0 and more Source cves: CVE-2022-22963 Source advisory: GHSA-6V73-FGF6-W5J7...

com.fnproject.fn:fn-spring-cloud-function (>=1.0.110, <=1.0.146), com.github.roneetshaw:fn-spring-cloud-function (>=0.0.22, <=2.0.21) +26 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.1.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: - com.fnproject.fn:fn-spring-cloud-function...

ai.hyacinth.framework:core-service-bus-support (0.5.24), cc.vihackerframework:vihacker-kafka-starter (>=1.0.4.r, <=1.0.6.r) +504 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.0.0.release, <=3.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.0.0.release, =1.0.4.r, =1.0.6.r - ch.voulgarakis:spring-cloud-stream-binder-jms 1.0.0.release - city.smartb.f2:f2-spring-boot-starter-function 0.1.0 - city.smartb.f2:f2-spring-boot-starter-function-http 0.1.0 -...

Spring Remote Code Execution: CVE-2022-22963 and CVE-2022-22965

SonicWall PSIRT is tracking two critical vulnerabilities impacting the Spring Framework. This advisory is intended to address both. 1CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring ExpressionIn Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported...

Vulnerability in Spring Cloud Function Framework Affecting Cisco Products: March 2022

On March 29, 2022, the following critical vulnerability in the Spring Cloud Function Framework affecting releases 3.1.6, 3.2.2, and older unsupported releases was disclosed: CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring Expression For a description of this...

CVE-2022-22963

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...

Remote code execution

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...

Metasploit Weekly Wrap-Up

CVE-2022-22963 - Spring Cloud Function SpEL RCE A new exploit/multi/http/springcloudfunctionspelinjection module has been developed by our very own Spencer McIntyre which targets Spring Cloud Function versions Prior to 3.1.7 and 3.2.3. This module is unrelated to Spring4Shell CVE-2022-22965, whic...

CVE-2022-22963

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...

CVE-2022-22963: Improper Control of Generation of Code

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...

Spring Releases Security Updates Addressing "Spring4Shell" and Spring Cloud Function Vulnerabilities

Spring by VMWare has released Spring Cloud Function versions 3.1.7 and 3.2.3 to address remote code execution RCE vulnerability CVE-2022-22963 as well as Spring Framework versions 5.3.18 and 5.2.20 to address RCE vulnerability CVE-2022-22965, known as “Spring4Shell.” A remote attacker could explo...

CVE-2022-22965 and CVE-2022-22963 vulnerabilities

Two distinct spring project vulnerabilities where released recently with critical CVSS score and classified as zero-Day attacks. The two vulnerabilities are currently known as : CVE-2022-22965 or Spring4Shell: A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remot...

CVE-2022-22963

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources. Recent assessments:...

CVE-2022-22963

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...

city.smartb.f2:f2-spring-boot-starter-function (>=0.2.2, <=0.6.0), city.smartb.f2:f2-spring-boot-starter-function-http (>=0.2.2, <=0.6.0) +338 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.2.0, <=3.2.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.6.0 and more Source cves: CVE-2022-22963 Source advisory: MEND:CVE-2022-22963...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.24), cc.vihackerframework:vihacker-kafka-starter (>=1.0.4.r, <=1.0.6.r) +815 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=1.0.0.release, <=3.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =1.0.0.release, =0.5.0, =1.0.4.r, =1.0.6.r - ch.voulgarakis:spring-cloud-stream-binder-jms 1.0.0.release - city.smartb.f2:f2-spring-boot-starter-function 0.1.0 - city.smartb.f2:f2-spring-boot-starter-function-http 0.1.0 -...

CVE-2022-22963

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources...