Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade spring boot to 3.2.8 or newer #729

Open
mattieserver opened this issue Jul 24, 2024 · 1 comment
Open

Upgrade spring boot to 3.2.8 or newer #729

mattieserver opened this issue Jul 24, 2024 · 1 comment

Comments

@mattieserver
Copy link

The current spring version (3.2.5) includes spring-boot-starter-tomcat (from spring-boot-starter-web) which has a security issue (CVE-2024-34750).

This CVE relates to a issue when using HTTP2. Reading the documentation from spring it seems like HTTP2 is not enabled by default so this does not impact the project directly.

However some security scanning tools only check the version and raise an issue, so we might as well just upgrade the spring version.
Upgrading to 3.2.8 should 'fix' the issue and you stay within the same minor version of spring.

@mattieserver
Copy link
Author

mattieserver commented Jul 24, 2024

If #713 is merged the issue would still be there.
Upgrade should be done to 3.3.1 or 3.3.2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant