CVE:CVE-2022-31691
CNNVD:CNNVD-202211-2088
Spring Tools是Spring的一系列用于辅助开发者编写程序的插件。
Spring Tools 存在安全漏洞，该漏洞源于支持YAML编辑的Snakeyaml库允许YAML中的一些特殊语法，在某些情况下允许攻击者执行潜在有害的远程代码。以下产品和版本受到影响：Spring Tools Suite 4.16.0及之前版本、Spring Boot Tools1.39.0及之前版本、Concourse CI Pipeline Editor1.39.0及之前版本、Bosh Editor1.39.0及之前版本和Cloudfoundry Manifest YML Support 1.39.0及之前版本。
solution:Upgrade vmware bosh_editor to a higher version than 1.40.0,and avoid the version [1.0.0,1.40.0); Upgrade vmware cloudfoundry_manifest_yml_support to a higher version than 1.40.0,and avoid the version [1.0.0,1.40.0); Upgrade vmware concourse_ci_pipeline_editor to a higher version than 1.40.0,and avoid the version [1.0.0,1.40.0); Upgrade vmware spring_boot_tools to a higher version than 1.40.0,and avoid the version [1.0.0,1.40.0); Upgrade vmware spring_tools to a higher version than 4.16.1,and avoid the version [4.0.0,4.16.1)