CVE:CVE-2022-22984
CNNVD:CNNVD-202211-3718
Snyk CLI是美国Snyk公司的一个构建时工具，用于查找和修复项目中的已知漏洞。
Snyk CLI 1.1064.0之前版本、snyk-mvn-plugin 2.31.3之前版本、snyk-gradle-plugin 3.24.5之前版本、snyk-cocoapods-plugin 2.5.3之前版本、snyk-sbt-plugin 2.16.2之前版本、snyk-python-plugin 1.24.2之前版本、snyk-docker-plugin 5.6.5之前版本、snyk-hex-plugin 1.1.6之前版本存在操作系统命令注入漏洞。攻击者利用该漏洞执行任意命令。
solution:Upgrade snyk snyk_cli to a higher version than 1.1064.0,and avoid the version (,1.1064.0); Upgrade snyk snyk_cocoapods_cli to a higher version than 2.5.3,and avoid the version (,2.5.3); Upgrade snyk snyk_docker_cli to a higher version than 5.6.5,and avoid the version (,5.6.5); Upgrade snyk snyk_gradle_cli to a higher version than 3.24.5,and avoid the version (,3.24.5); Upgrade snyk snyk_hex_cli to a higher version than 1.1.6,and avoid the version (,1.1.6); Upgrade snyk snyk_maven_cli to a higher version than 2.31.3,and avoid the version (,2.31.3); Upgrade snyk snyk_python_cli to a higher version than 1.24.2,and avoid the version (,1.24.2); Upgrade snyk snyk_sbt_cli to a higher version than 2.16.2,and avoid the version (,2.16.2)