CVE-2022-31139

描述

### Overview Affected versions have no limit to using unsafe-accessor. Can be ignored if `SecurityCheck.AccessLimiter` not setup ### Details If UA was loaded as a named module, the internal data of UA will be protected by JVM and others can only access UA via UA's standard api. Main application can setup `SecurityCheck.AccessLimiter` for UA to limit accesses to UA. Untrusted code can access UA without lmitation in affected versions even UA was loaded as a named module. ### References [The commit to fix](https://github.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fd)

如何修補 CVE-2022-31139

要修補 CVE-2022-31139,請將受影響套件升級到下列已修補版本。

• —升級至 1.7.0 或更新版本

CVE-2022-31139 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 1.4.0, < 1.7.0

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-31139
• PATCHgithub.com/Karlatemp/UnsafeAccessor
• WEBgithub.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fd
• WEBgithub.com/Karlatemp/UnsafeAccessor/releases/tag/1.7.0