From 07db57304e2444ca58b0a398febc982eedf0cc41 Mon Sep 17 00:00:00 2001
From: Cameron Rushton <cameron.rushton@rogers.com>
Date: Fri, 22 Mar 2024 08:15:27 -0400
Subject: [PATCH] DATAGO-73412: event-management-agent:spring-web:6.0.17,Type:
 app_dependency,Prisma Cloud Vulnerability (#172)

---
 service/confluent-schema-registry-plugin/pom.xml | 8 ++++++++
 service/kafka-plugin/pom.xml                     | 8 ++++++++
 service/local-storage-plugin/pom.xml             | 8 ++++++++
 service/pom.xml                                  | 8 ++++++++
 service/rabbitmq-plugin/pom.xml                  | 8 ++++++++
 service/solace-plugin/pom.xml                    | 8 ++++++++
 service/terraform-plugin/pom.xml                 | 8 ++++++++
 7 files changed, 56 insertions(+)

diff --git a/service/confluent-schema-registry-plugin/pom.xml b/service/confluent-schema-registry-plugin/pom.xml
index 69d7ee2c..09974307 100644
--- a/service/confluent-schema-registry-plugin/pom.xml
+++ b/service/confluent-schema-registry-plugin/pom.xml
@@ -17,6 +17,7 @@
         <maven-shade-plugin.version>3.3.0</maven-shade-plugin.version>
         <jackson-dataformat-cbor.version>2.13.4</jackson-dataformat-cbor.version>
         <maven-surefire-plugin.version>2.22.0</maven-surefire-plugin.version>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
     <dependencies>
         <dependency>
@@ -60,6 +61,13 @@
             <version>${jupiter.version}</version>
             <scope>test</scope>
         </dependency>
+        <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-web</artifactId>
+            <version>${spring-web.version}</version>
+        </dependency>
     </dependencies>
     <build>
         <plugins>
diff --git a/service/kafka-plugin/pom.xml b/service/kafka-plugin/pom.xml
index 353275c8..aaca8498 100644
--- a/service/kafka-plugin/pom.xml
+++ b/service/kafka-plugin/pom.xml
@@ -22,6 +22,7 @@
         <maven-shade-plugin.version>3.3.0</maven-shade-plugin.version>
         <maven-surefire-plugin.version>2.22.0</maven-surefire-plugin.version>
         <jackson.version>2.16.1</jackson.version>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
 
     <dependencyManagement>
@@ -33,6 +34,13 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-web</artifactId>
+                <version>${spring-web.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
diff --git a/service/local-storage-plugin/pom.xml b/service/local-storage-plugin/pom.xml
index 45812333..6baad215 100644
--- a/service/local-storage-plugin/pom.xml
+++ b/service/local-storage-plugin/pom.xml
@@ -22,6 +22,7 @@
         <maven-shade-plugin.version>3.3.0</maven-shade-plugin.version>
         <maven-surefire-plugin.version>2.22.0</maven-surefire-plugin.version>
         <jackson.version>2.16.1</jackson.version>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
     <dependencyManagement>
         <dependencies>
@@ -32,6 +33,13 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-web</artifactId>
+                <version>${spring-web.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <dependencies>
diff --git a/service/pom.xml b/service/pom.xml
index a9a3277a..5ee0bbaa 100644
--- a/service/pom.xml
+++ b/service/pom.xml
@@ -42,6 +42,7 @@
         <jacoco.line.percentage>0.8</jacoco.line.percentage>
         <camel.version>4.2.0</camel.version>
         <mockito-inline.version>5.2.0</mockito-inline.version>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
 
     <dependencyManagement>
@@ -70,6 +71,13 @@
                     </exclusion>
                 </exclusions>
             </dependency>
+            <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-web</artifactId>
+                <version>${spring-web.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
diff --git a/service/rabbitmq-plugin/pom.xml b/service/rabbitmq-plugin/pom.xml
index 2e0ec290..2ffeb3b8 100644
--- a/service/rabbitmq-plugin/pom.xml
+++ b/service/rabbitmq-plugin/pom.xml
@@ -10,6 +10,7 @@
     <properties>
         <maven.compiler.source>17</maven.compiler.source>
         <maven.compiler.target>17</maven.compiler.target>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
     <dependencies>
         <dependency>
@@ -27,6 +28,13 @@
             <artifactId>plugin</artifactId>
             <version>1.6.3-SNAPSHOT</version>
         </dependency>
+        <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-web</artifactId>
+            <version>${spring-web.version}</version>
+        </dependency>
     </dependencies>
     <build>
         <plugins>
diff --git a/service/solace-plugin/pom.xml b/service/solace-plugin/pom.xml
index e0b026b5..65e7ca29 100644
--- a/service/solace-plugin/pom.xml
+++ b/service/solace-plugin/pom.xml
@@ -21,6 +21,7 @@
         <maven-shade-plugin.version>3.3.0</maven-shade-plugin.version>
         <maven-surefire-plugin.version>2.22.0</maven-surefire-plugin.version>
         <jackson.version>2.16.0</jackson.version>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
 
     <dependencyManagement>
@@ -32,6 +33,13 @@
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
+            <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+            <dependency>
+                <groupId>org.springframework</groupId>
+                <artifactId>spring-web</artifactId>
+                <version>${spring-web.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
 
diff --git a/service/terraform-plugin/pom.xml b/service/terraform-plugin/pom.xml
index 32cb1b6b..613b113c 100644
--- a/service/terraform-plugin/pom.xml
+++ b/service/terraform-plugin/pom.xml
@@ -19,6 +19,7 @@
         <maven-surefire-plugin.version>2.22.0</maven-surefire-plugin.version>
         <maas.jobs.version>2.0.11</maas.jobs.version>
         <jackson.version>2.16.1</jackson.version>
+        <spring-web.version>6.0.18</spring-web.version>
     </properties>
     <dependencies>
         <dependency>
@@ -88,6 +89,13 @@
                 </exclusion>
             </exclusions>
         </dependency>
+        <!-- Override version 6.0.17 from spring-boot-starter-web 3.1.9 that has a vulnerability without moving to
+         v3.2.3 which uses 6.1.4 (we would require 6.1.5) -->
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-web</artifactId>
+            <version>${spring-web.version}</version>
+        </dependency>
     </dependencies>
     <build>
         <plugins>