[
https://issues.apache.org/jira/browse/WW-5717?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5717:
------------------------------
Description:
The OWASP dependency-check run (the {{owasp-nvd-api}} profile, which is
configured with {{failBuildOnCVSS=0}} so it reports every CVE regardless of
severity) flags a vulnerability in Spring Framework's {{spring-core}}.
This is a dependency-hygiene item, independent of any current feature branch —
no source change introduced it; it stems from the pinned Spring version.
h3. Current Spring versions
* _main (7.x):_ {{spring.version}} = {{6.2.19}} (default), {{7.0.8}}
(jakartaee11 profile)
* _support/struts-6-x-x (6.x):_ {{spring.platformVersion}} = {{5.3.39}}
Both lines should be checked against the reported CVE, since they track
different Spring release lines.
h3. Resolution options
# _Upgrade_ Spring to the latest patch of its respective line (6.2.x / 7.0.x on
main, 5.3.x on 6.x) if the CVE is fixed upstream, and confirm the finding
clears.
# _Suppress_ the finding in the OWASP suppression file
({{src/etc/project-suppression.xml}}) if the CVE does not apply to how Struts
uses Spring (a common situation for dependency-check + Spring). The file
already curates such false positives; no Spring CVE is suppressed there today.
h3. Notes
* {{spring-core}} is not shipped by every module; e.g. the Tiles plugin only
pulls {{spring-test}} (test scope).
* The exact CVE id from the scan output should be recorded here to drive the
decision (upgrade vs. suppress) and to document the rationale if suppressed.
was:
The OWASP dependency-check run (the {{owasp-nvd-api}} profile, which is
configured with {{failBuildOnCVSS=0}} so it reports every CVE regardless of
severity) flags a vulnerability in Spring Framework's {{spring-core}}.
This is a dependency-hygiene item, independent of any current feature branch —
no source change introduced it; it stems from the pinned Spring version.
h3. Current Spring versions
* _main (7.x):_ {{spring.version}} = {{6.2.19}} (default), {{7.0.8}}
(jakartaee11 profile)
* _support/struts-6-x-x (6.x):_ {{spring.platformVersion}} = {{5.3.39}}
Both lines should be checked against the reported CVE, since they track
different Spring release lines.
h3. Resolution options
h1. _Upgrade_ Spring to the latest patch of its respective line (6.2.x / 7.0.x
on main, 5.3.x on 6.x) if the CVE is fixed upstream, and confirm the finding
clears.
h1. _Suppress_ the finding in the OWASP suppression file
({{src/etc/project-suppression.xml}}) if the CVE does not apply to how Struts
uses Spring (a common situation for dependency-check + Spring). The file
already curates such false positives; no Spring CVE is suppressed there today.
h3. Notes
* {{spring-core}} is not shipped by every module; e.g. the Tiles plugin only
pulls {{spring-test}} (test scope).
* The exact CVE id from the scan output should be recorded here to drive the
decision (upgrade vs. suppress) and to document the rationale if suppressed.
> Address OWASP dependency-check finding in Spring Framework (spring-core)
> ------------------------------------------------------------------------
>
> Key: WW-5717
> URL: https://issues.apache.org/jira/browse/WW-5717
> Project: Struts 2
> Issue Type: Task
> Reporter: Lukasz Lenart
> Priority: Major
>
> The OWASP dependency-check run (the {{owasp-nvd-api}} profile, which is
> configured with {{failBuildOnCVSS=0}} so it reports every CVE regardless of
> severity) flags a vulnerability in Spring Framework's {{spring-core}}.
> This is a dependency-hygiene item, independent of any current feature branch
> — no source change introduced it; it stems from the pinned Spring version.
> h3. Current Spring versions
> * _main (7.x):_ {{spring.version}} = {{6.2.19}} (default), {{7.0.8}}
> (jakartaee11 profile)
> * _support/struts-6-x-x (6.x):_ {{spring.platformVersion}} = {{5.3.39}}
> Both lines should be checked against the reported CVE, since they track
> different Spring release lines.
> h3. Resolution options
> # _Upgrade_ Spring to the latest patch of its respective line (6.2.x / 7.0.x
> on main, 5.3.x on 6.x) if the CVE is fixed upstream, and confirm the finding
> clears.
> # _Suppress_ the finding in the OWASP suppression file
> ({{src/etc/project-suppression.xml}}) if the CVE does not apply to how Struts
> uses Spring (a common situation for dependency-check + Spring). The file
> already curates such false positives; no Spring CVE is suppressed there today.
> h3. Notes
> * {{spring-core}} is not shipped by every module; e.g. the Tiles plugin only
> pulls {{spring-test}} (test scope).
> * The exact CVE id from the scan output should be recorded here to drive the
> decision (upgrade vs. suppress) and to document the rationale if suppressed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
