DATAGO-73412: event-management-agent:spring-web:6.0.17,Type: app_depe…

…ndency,Prisma Cloud Vulnerability (#172)
SolaceProducts · Mar 22, 2024 · 07db573 · 07db573
1 parent 0878ad6
commit 07db573
Show file tree

Hide file tree

Showing 7 changed files with 56 additions and 0 deletions.
diff --git a/service/confluent-schema-registry-plugin/pom.xml b/service/confluent-schema-registry-plugin/pom.xml
@@ -17,6 +17,7 @@
         <maven-shade-plugin.version>3.3.0</maven-shade-plugin.version>
         <jackson-dataformat-cbor.version>2.13.4</jackson-dataformat-cbor.version>
         <maven-surefire-plugin.version>2.22.0</maven-surefire-plugin.version>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
     <dependencies>
         <dependency>
@@ -60,6 +61,13 @@
             <version>${jupiter.version}</version>
             <scope>test</scope>
         </dependency>
+        <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-web</artifactId>
+            <version>${spring-web.version}</version>
+        </dependency>
     </dependencies>
     <build>
         <plugins>

diff --git a/service/kafka-plugin/pom.xml b/service/kafka-plugin/pom.xml
@@ -22,6 +22,7 @@
         <maven-shade-plugin.version>3.3.0</maven-shade-plugin.version>
         <maven-surefire-plugin.version>2.22.0</maven-surefire-plugin.version>
         <jackson.version>2.16.1</jackson.version>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
 
     <dependencyManagement>
@@ -33,6 +34,13 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-web</artifactId>
+                <version>${spring-web.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 

diff --git a/service/local-storage-plugin/pom.xml b/service/local-storage-plugin/pom.xml
@@ -22,6 +22,7 @@
         <maven-shade-plugin.version>3.3.0</maven-shade-plugin.version>
         <maven-surefire-plugin.version>2.22.0</maven-surefire-plugin.version>
         <jackson.version>2.16.1</jackson.version>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
     <dependencyManagement>
         <dependencies>
@@ -32,6 +33,13 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-web</artifactId>
+                <version>${spring-web.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <dependencies>

diff --git a/service/pom.xml b/service/pom.xml
@@ -42,6 +42,7 @@
         <jacoco.line.percentage>0.8</jacoco.line.percentage>
         <camel.version>4.2.0</camel.version>
         <mockito-inline.version>5.2.0</mockito-inline.version>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
 
     <dependencyManagement>
@@ -70,6 +71,13 @@
                     </exclusion>
                 </exclusions>
             </dependency>
+            <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-web</artifactId>
+                <version>${spring-web.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 

diff --git a/service/rabbitmq-plugin/pom.xml b/service/rabbitmq-plugin/pom.xml
@@ -10,6 +10,7 @@
     <properties>
         <maven.compiler.source>17</maven.compiler.source>
         <maven.compiler.target>17</maven.compiler.target>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
     <dependencies>
         <dependency>
@@ -27,6 +28,13 @@
             <artifactId>plugin</artifactId>
             <version>1.6.3-SNAPSHOT</version>
         </dependency>
+        <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-web</artifactId>
+            <version>${spring-web.version}</version>
+        </dependency>
     </dependencies>
     <build>
         <plugins>

diff --git a/service/solace-plugin/pom.xml b/service/solace-plugin/pom.xml
@@ -21,6 +21,7 @@
         <maven-shade-plugin.version>3.3.0</maven-shade-plugin.version>
         <maven-surefire-plugin.version>2.22.0</maven-surefire-plugin.version>
         <jackson.version>2.16.0</jackson.version>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
 
     <dependencyManagement>
@@ -32,6 +33,13 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-web</artifactId>
+                <version>${spring-web.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 

diff --git a/service/terraform-plugin/pom.xml b/service/terraform-plugin/pom.xml
@@ -19,6 +19,7 @@
         <maven-surefire-plugin.version>2.22.0</maven-surefire-plugin.version>
         <maas.jobs.version>2.0.11</maas.jobs.version>
         <jackson.version>2.16.1</jackson.version>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
     <dependencies>
         <dependency>
@@ -88,6 +89,13 @@
                 </exclusion>
             </exclusions>
         </dependency>
+        <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-web</artifactId>
+            <version>${spring-web.version}</version>
+        </dependency>
     </dependencies>
     <build>
         <plugins>