[jira] [Updated] (WW-5717) Address OWASP dependency-check finding in Spring Framework (spring-core)

["Lukasz Lenart (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/WW-5717?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Lukasz Lenart updated WW-5717:
------------------------------
    Description: 
The OWASP dependency-check run (the {{owasp-nvd-api}} profile, which is configured with {{failBuildOnCVSS=0}} so it reports every CVE regardless of severity) flags a vulnerability in Spring Framework's {{spring-core}}.

This is a dependency-hygiene item, independent of any current feature branch — no source change introduced it; it stems from the pinned Spring version.

h3. Current Spring versions
* _main (7.x):_ {{spring.version}} = {{6.2.19}} (default), {{7.0.8}} (jakartaee11 profile)
* _support/struts-6-x-x (6.x):_ {{spring.platformVersion}} = {{5.3.39}}

Both lines should be checked against the reported CVE, since they track different Spring release lines.

h3. Resolution options
# _Upgrade_ Spring to the latest patch of its respective line (6.2.x / 7.0.x on main, 5.3.x on 6.x) if the CVE is fixed upstream, and confirm the finding clears.
# _Suppress_ the finding in the OWASP suppression file ({{src/etc/project-suppression.xml}}) if the CVE does not apply to how Struts uses Spring (a common situation for dependency-check + Spring). The file already curates such false positives; no Spring CVE is suppressed there today.

h3. Notes
* {{spring-core}} is not shipped by every module; e.g. the Tiles plugin only pulls {{spring-test}} (test scope).
* The exact CVE id from the scan output should be recorded here to drive the decision (upgrade vs. suppress) and to document the rationale if suppressed.

  was:
The OWASP dependency-check run (the {{owasp-nvd-api}} profile, which is configured with {{failBuildOnCVSS=0}} so it reports every CVE regardless of severity) flags a vulnerability in Spring Framework's {{spring-core}}.

This is a dependency-hygiene item, independent of any current feature branch — no source change introduced it; it stems from the pinned Spring version.

h3. Current Spring versions
* _main (7.x):_ {{spring.version}} = {{6.2.19}} (default), {{7.0.8}} (jakartaee11 profile)
* _support/struts-6-x-x (6.x):_ {{spring.platformVersion}} = {{5.3.39}}

Both lines should be checked against the reported CVE, since they track different Spring release lines.

h3. Resolution options

h1. _Upgrade_ Spring to the latest patch of its respective line (6.2.x / 7.0.x on main, 5.3.x on 6.x) if the CVE is fixed upstream, and confirm the finding clears.
h1. _Suppress_ the finding in the OWASP suppression file ({{src/etc/project-suppression.xml}}) if the CVE does not apply to how Struts uses Spring (a common situation for dependency-check + Spring). The file already curates such false positives; no Spring CVE is suppressed there today.

h3. Notes
* {{spring-core}} is not shipped by every module; e.g. the Tiles plugin only pulls {{spring-test}} (test scope).
* The exact CVE id from the scan output should be recorded here to drive the decision (upgrade vs. suppress) and to document the rationale if suppressed.


> Address OWASP dependency-check finding in Spring Framework (spring-core)
> ------------------------------------------------------------------------
>
>                 Key: WW-5717
>                 URL: https://issues.apache.org/jira/browse/WW-5717
>             Project: Struts 2
>          Issue Type: Task
>            Reporter: Lukasz Lenart
>            Priority: Major
>
> The OWASP dependency-check run (the {{owasp-nvd-api}} profile, which is configured with {{failBuildOnCVSS=0}} so it reports every CVE regardless of severity) flags a vulnerability in Spring Framework's {{spring-core}}.
> This is a dependency-hygiene item, independent of any current feature branch — no source change introduced it; it stems from the pinned Spring version.
> h3. Current Spring versions
> * _main (7.x):_ {{spring.version}} = {{6.2.19}} (default), {{7.0.8}} (jakartaee11 profile)
> * _support/struts-6-x-x (6.x):_ {{spring.platformVersion}} = {{5.3.39}}
> Both lines should be checked against the reported CVE, since they track different Spring release lines.
> h3. Resolution options
> # _Upgrade_ Spring to the latest patch of its respective line (6.2.x / 7.0.x on main, 5.3.x on 6.x) if the CVE is fixed upstream, and confirm the finding clears.
> # _Suppress_ the finding in the OWASP suppression file ({{src/etc/project-suppression.xml}}) if the CVE does not apply to how Struts uses Spring (a common situation for dependency-check + Spring). The file already curates such false positives; no Spring CVE is suppressed there today.
> h3. Notes
> * {{spring-core}} is not shipped by every module; e.g. the Tiles plugin only pulls {{spring-test}} (test scope).
> * The exact CVE id from the scan output should be recorded here to drive the decision (upgrade vs. suppress) and to document the rationale if suppressed.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)