com.alipay.sofa:sofa-boot-autoconfigure (>=3.16.2, <=3.25.0), com.alipay.sofa:tracer-sofa-boot-starter (>=3.1.0, <=3.1.2) +378 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.0.0.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: - com.alipay.sofa:sofa-boot-autoconfigure...

ai.hyacinth.framework:core-service-bus-support (0.5.0), com.alibaba.cloud:spring-cloud-starter-bus-rocketmq (>=2.1.0.release, <=2.1.4.release) +138 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.0.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

ai.hyacinth.framework:core-service-bus-support (>=0.5.2, <=0.5.21), cn.springcloud.gray:spring-cloud-gray-plugin-event-stream (>=c.0.0.1, <=c.0.0.5) +375 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.0.2.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

com.solace.spring.cloud:spring-cloud-starter-stream-solace (>=1.2.0, <=1.2.1), com.solace.spring.cloud:spring-cloud-stream-binder-solace (>=1.2.0, <=1.2.1) +43 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.1.0.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: -...

com.fnproject.fn:fn-spring-cloud-function (>=1.0.110, <=1.0.146), com.github.roneetshaw:fn-spring-cloud-function (>=0.0.22, <=2.0.21) +26 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (2.1.1.release)

org.springframework.cloud:spring-cloud-function-context MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-function-context and may be impacted: - com.fnproject.fn:fn-spring-cloud-function...

city.smartb.f2:f2-spring-boot-starter-function (>=0.2.2, <=0.6.0), city.smartb.f2:f2-spring-boot-starter-function-http (>=0.2.2, <=0.6.0) +338 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.2.0, <=3.2.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.6.0 and more Source cves: CVE-2022-22963 Source advisory: GHSA-6V73-FGF6-W5J7...

city.smartb.f2:f2-spring-boot-starter-function (>=0.2.2, <=0.6.0), city.smartb.f2:f2-spring-boot-starter-function-http (>=0.2.2, <=0.6.0) +338 more potentially affected by CVE-2022-22963 via org.springframework.cloud:spring-cloud-function-context (>=3.2.0, <=3.2.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.0, =0.2.2, =0.2.2, =0.2.2, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.6.0 and more Source cves: CVE-2022-22963 Source advisory: MEND:CVE-2022-22963...

Remote Code Execution

spring-cloud-function-context is vulnerable to remote code execution. The routing functionality allows a user to provide a malicious SpEL as a routing-expression which would allow arbitrary OS commands to be executed remotely...