ADM: Fix CVE Issues #55
Conversation
There was a problem hiding this comment.
Current version of Spring Boot is 2.7.3. Remaining on 2.6.4, while it fixes a number of vulnerabilities, does not resolve all detected issues.
Similarly the current version of gson is 2.9.1. While 2.8.9 does not yet have any detected vulnerabilities is there some technical reason why we can't upgrade to the current version? (2.8.9 is nearly a year old already.)
|
@locke-chappel Will you please approve if this looks fine? |
|
@locke-chappel Please have a look and approve if things look fine. |
There was a problem hiding this comment.
Assuming using snakeyaml 1.33 (e.g. > 1.30) with Spring Boot < 2.7.4 works at runtime this should be good. Note that according to the Spring team this may cause runtime a exception in some cases which is why they made a change in 2.7.4 to support snakeyaml 1.31+.
From a security scan point we are good.
Upgrade Spring Boot and Gson versions.