Description
Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache ShenYu (incubating) | Apache ShenYu (incubating) – < 2.4.2 | 2.4.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.shenyu:shenyu-common | >= 2.4.0, < 2.4.2 | 2.4.2 | GHSA-gh38-x2wm-xmc8 |
References
- https://lists.apache.org/thread/3zzmwvg3012tg306x8o893fvdcssx639
- [oss-security] 20220125 CVE-2021-45029: Groovy Code Injection & SpEL Injection in Apache ShenYu 2.4.1 mailing-list
- [oss-security] 20220126 CVE-2021-45029: Apache ShenYu (incubating) Groovy Code Injection and SpEL Injection mailing-list