Skip to content

Commit

Permalink
fix: UAA 74.5 is vulnerable to CVE-2024-22243
Browse files Browse the repository at this point in the history
- Because it depends on Spring Framework 5.3.31 and uses UriComponentsBuilder.
- So bumped Spring Framework to 5.3.32 per https://spring.io/security/cve-2024-22243.
  • Loading branch information
hsinn0 committed Feb 29, 2024
1 parent 46b1629 commit 77e746c
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions dependencies.gradle
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ ext["flyway.version"] = "7.15.0" // flyway 8+ drops support for mysql 5.7
ext["mariadb.version"] = "2.7.11" // Bumping to v3 breaks some pipeline jobs (and compatibility with Amazon Aurora MySQL), so pinning to v2 for now. v2 (current version) is stable and will be supported until about September 2025 (https://mariadb.com/kb/en/about-mariadb-connector-j/).
ext["snakeyaml.version"] = "2.2" // Needed to resolve CVEs in internal spring-boot 2.7.12 inclusion of snakeyaml
ext["jackson-bom.version"] = "2.16.1" // Bumping to latest version because of compatibility to snakeyaml 2.0
ext["spring-framework.version"] = "5.3.32" // Bumping to latest version 5 patch for CVE-2024-22243
ext["selenium.version"] = "${versions.seleniumVersion}"

ext {
Expand Down

0 comments on commit 77e746c

Please sign in to comment.