确认

  • [X] 我使用的版本是最新版, 并且使用插件确认过项目里无依赖版本冲突
  • [X] 我已经在 issue 中搜索过, 确认问题没有被提出过
  • [x] 我已经修改标题, 将标题中的 描述 替换为遇到的问题

当前程序版本

3.5.9

问题描述

在pom文件中引入mybatis-plus-spring-boot3-starter依赖时IDE提示其依赖项中存在漏洞，提示如下： 1. maven:ch.qos.logback:logback-core:1.5.12 vulnerable; 解决方式为升级依赖项的版本，具体见日志部分

详细堆栈日志

依赖项 maven:ch.qos.logback:logback-core:1.5.12 vulnerable

升级到 1.5.13

GHSA-pr98-23f8-jwxv，分数: 5.9

ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core up to and including version 1.5.12 in Java applications allows attackers to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension.
A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

阅读更多: https://osv.dev/vulnerability/GHSA-pr98-23f8-jwxv

GHSA-6v67-2wr5-gvf4，分数: 2.4

Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.
The attacks involves the modification of DOCTYPE declaration in  XML configuration files.

阅读更多: https://osv.dev/vulnerability/GHSA-6v67-2wr5-gvf4

结果由 OSV 提供技术支持
-------------------------------------

Comment From: nieqiurong

https://github.com/spring-projects/spring-boot/issues/43568

Comment From: nieqiurong

mybatis-plus并不强依赖logback，请自行等待spring-boot发布新版本升级.