Address json-path CVE-2023-51074 #5643
Assignees
Milestone
Comments
corneil
added a commit
to corneil/spring-cloud-dataflow
that referenced
this issue
Jan 17, 2024
Had to add entries to dependencyManagement sections because adding the version property wasn't changing all the versions. Presuming that some external dependencies includes 2.7.0 directly and not via a property and is encountered before boot dependencies. Fixes spring-cloud#5643
|
Have you considered using Dependabot? That way not only this but all other dependencies will be updated automatically |
|
Hi @yeikel , yes we use dependabot. In this case, the fix is. not yet available so dependabot is not helpful. |
onobc
changed the title
corneil
added a commit
to corneil/spring-cloud-dataflow
that referenced
this issue
Jan 22, 2024
Had to add entries to dependencyManagement sections because adding the version property wasn't changing all the versions. Presuming that some external dependencies includes 2.7.0 directly and not via a property and is encountered before boot dependencies. Fixes spring-cloud#5643
corneil
added a commit
to corneil/spring-cloud-dataflow
that referenced
this issue
Jan 23, 2024
corneil
added a commit
to corneil/spring-cloud-dataflow
that referenced
this issue
Jan 23, 2024
onobc
pushed a commit
that referenced
this issue
Jan 23, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
JsonPath version
<= 2.8.0has CVE-2023-51074 and the fix is yet to be released but should be soon.When fix is available, update to version
2.9.0and be sure to cover the following repos:spring-cloud-dataflowspring-cloud-deployerscs-dataflow(tile)The text was updated successfully, but these errors were encountered: