org.springframework.cloud:spring-cloud-function-adapter-aws (1.0.1.release), org.springframework.cloud:spring-cloud-function-adapter-azure (1.0.1.release) +6 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (1.0.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 1.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

city.smartb.f2:f2-spring-boot-starter-function (>=0.2.2, <=0.6.0), city.smartb.f2:f2-spring-boot-starter-function-http (>=0.2.2, <=0.6.0) +338 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.2.0, <=3.2.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.6.0 and more Source cves: CVE-2022-22963 Source advisory: OSV:GHSA-6V73-FGF6-W5J7...

com.fnproject.fn:fn-spring-cloud-function (>=1.0.110, <=1.0.146), com.github.roneetshaw:fn-spring-cloud-function (>=0.0.22, <=2.0.21) +26 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.1.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: - com.fnproject.fn:fn-spring-cloud-function...

ai.hyacinth.framework:core-service-bus-support (0.5.24), cc.vihackerframework:vihacker-kafka-starter (>=1.0.4.r, <=1.0.6.r) +504 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.0.0.release, <=3.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.0.0.release, =1.0.4.r, =1.0.6.r - ch.voulgarakis:spring-cloud-stream-binder-jms 1.0.0.release - city.smartb.f2:f2-spring-boot-starter-function 0.1.0 - city.smartb.f2:f2-spring-boot-starter-function-http 0.1.0 -...

ai.hyacinth.framework:core-service-bus-support (0.5.0), com.alibaba.cloud:spring-cloud-starter-bus-rocketmq (>=2.1.0.release, <=2.1.4.release) +138 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.0.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

ai.hyacinth.framework:core-service-bus-support (>=0.5.2, <=0.5.21), cn.springcloud.gray:spring-cloud-gray-plugin-event-stream (>=c.0.0.1, <=c.0.0.5) +375 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.0.2.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

city.smartb.f2:f2-spring-boot-starter-function (>=0.2.2, <=0.6.0), city.smartb.f2:f2-spring-boot-starter-function-http (>=0.2.2, <=0.6.0) +338 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.2.0, <=3.2.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.6.0 and more Source cves: CVE-2022-22963 Source advisory: MEND:CVE-2022-22963...

Remote Code Execution

spring-cloud-function-context is vulnerable to remote code execution. The routing functionality allows a user to provide a malicious SpEL as a routing-expression which would allow arbitrary OS commands to be executed remotely...