[Solved] org.springframework:spring-web.5.3.31 vulnerability
I am bugging the devs about this right now. Should have an answer in a little bit.
There's been a wave of CVE stuff recently with a lot of the packages we utilize. So far it's been 100% okay to update, but I want to double check before I say yes.
There's been a wave of CVE stuff recently with a lot of the packages we utilize. So far it's been 100% okay to update, but I want to double check before I say yes.
Okay, spring framework is really important to the Unimus UI. Updating it or possibly just the web portion might be possible, but there are a lot of dependencies we rely on and it's hairy.
We are looking into options and if we have work arounds or mitigations I will report back here.
We are looking into options and if we have work arounds or mitigations I will report back here.
Unimus is NOT affected by this issue / CVE.
This is an old CVE (from 2016) that was republished against a newer version of Spring this month for some reason - not officially by Spring. You can see more info here: https://github.com/spring-projects/spri ... -579669626
We do NOT use nor expose HTTP Invoker endpoints, and as such Unimus should not be considered vulnerable. As Tommy mentioned, the Spring Web framework is a foundational component of Unimus. I can't be upgraded easily - basically requires a whole lot of migration rewrites to migrate to v6.
We will see what we can do, if there is an easier way for Unimus to not get flagged by scanners. But as I mentioned, we / you are not affected
This is an old CVE (from 2016) that was republished against a newer version of Spring this month for some reason - not officially by Spring. You can see more info here: https://github.com/spring-projects/spri ... -579669626
We do NOT use nor expose HTTP Invoker endpoints, and as such Unimus should not be considered vulnerable. As Tommy mentioned, the Spring Web framework is a foundational component of Unimus. I can't be upgraded easily - basically requires a whole lot of migration rewrites to migrate to v6.
We will see what we can do, if there is an easier way for Unimus to not get flagged by scanners. But as I mentioned, we / you are not affected