Uploaded image for project: 'Apache Ozone'
  1. Apache Ozone
  2. HDDS-10815

Bump Spring Framework to 5.3.34

    XMLWordPrintableJSON

Details

    Description

      Upgrade Spring Framework to 5.3.34 due to CVE-2024-22243, CVE-2024-22259 and CVE-2024-22262

      CVE-2024-22243:- Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.
      https://spring.io/security/cve-2024-22243 
      https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586 

      CVE-2024-22262:- Affected versions of this package are vulnerable to Open Redirect when UriComponentsBuilder is used to parse an externally provided URL and perform validation checks on the host of the parsed URL.
      https://spring.io/security/cve-2024-22262 
      https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980 

      CVE-2024-22259:- Affected versions of this package are vulnerable to Open Redirect when using UriComponentsBuilder to parse an externally provided URL and perform validation checks on the host of the parsed URL.
      https://spring.io/security/cve-2024-22259 
      https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790 

      Attachments

        Issue Links

          Activity

            People

              rohit.kumar Rohit Kumar
              rohit.kumar Rohit Kumar
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: