You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@nifi.apache.org by "David Handermann (Jira)" <ji...@apache.org> on 2022/03/31 16:08:00 UTC

[jira] [Created] (NIFI-9852) Upgrade Spring Framework to 5.3.18

David Handermann created NIFI-9852:
--------------------------------------

             Summary: Upgrade Spring Framework to 5.3.18
                 Key: NIFI-9852
                 URL: https://issues.apache.org/jira/browse/NIFI-9852
             Project: Apache NiFi
          Issue Type: Improvement
          Components: Core Framework, Extensions, NiFi Registry, Security
    Affects Versions: 1.16.0
            Reporter: David Handermann
            Assignee: David Handermann


Spring Framework 5.3.18 corrects several issues, including [CVE-2022-22965|https://tanzu.vmware.com/security/CVE-2022-22965]. Spring Boot for NiFi Registry should also be upgraded to 2.6.6.

The [Spring Framework announcement|https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement] lists the criteria for exploiting the vulnerability. Based on the current summary, NiFi and NiFi Registry do not appear to be impacted as both applications use Jetty instead of Apache Tomcat, and use JAX-RS with Jersey instead of Spring WebMVC or Spring Webflux for defining REST resources.

Upgrading these dependencies mitigates potential issues.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)