CVE-2022-31691: Code Injection
Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31691?
The severity of CVE-2022-31691 is classified as medium due to the potential for remote code execution in affected versions.
How do I fix CVE-2022-31691?
To fix CVE-2022-31691, update Spring Tools for Eclipse to version 4.16.1 or above, and upgrade all affected VSCode extensions to version 1.40.0 or higher.
Which software is affected by CVE-2022-31691?
CVE-2022-31691 affects Spring Tools 4 for Eclipse version 4.16.0 and below, along with several VSCode extensions from VMware including Spring Boot Tools and Cloudfoundry Manifest YML Support.
What components use the Snakeyaml library affected by CVE-2022-31691?
The components using the vulnerable Snakeyaml library are Spring Tools for Eclipse, Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor, and Cloudfoundry Manifest YML Support.
Is there a known exploit for CVE-2022-31691?
Yes, CVE-2022-31691 has known exploits that leverage vulnerabilities in the Snakeyaml library for executing arbitrary code.