PT-2022-20891 · Spring · Spring Tools 4 For Eclipse+1

Zewei Zhang · Published 2022-11-04 · Updated 2023-08-08 · CVE-2022-31691

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring Tools 4 for Eclipse version 4.16.0 and below Spring Boot Tools version 1.39.0 and below Concourse CI Pipeline Editor version 1.39.0 and below Bosh Editor version 1.39.0 and below Cloudfoundry Manifest YML Support version 1.39.0 and below

Description The issue concerns the use of the Snakeyaml library for YAML editing support, which allows for special syntax in YAML files. Under certain circumstances, this can lead to potentially harmful remote code execution by an attacker.

Recommendations For Spring Tools 4 for Eclipse version 4.16.0 and below, update to a version above 4.16.0 to resolve the issue. For Spring Boot Tools version 1.39.0 and below, update to a version above 1.39.0 to resolve the issue. For Concourse CI Pipeline Editor version 1.39.0 and below, update to a version above 1.39.0 to resolve the issue. For Bosh Editor version 1.39.0 and below, update to a version above 1.39.0 to resolve the issue. For Cloudfoundry Manifest YML Support version 1.39.0 and below, update to a version above 1.39.0 to resolve the issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-31691

Affected Products

Spring Boot Tools

Spring Tools 4 For Eclipse

References · 3

• https://osv.dev/vulnerability/CVE-2022-31691 · Vendor Advisory
• https://tanzu.vmware.com/security/cve-2022-31691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31691 · Security Note