Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade ecChronos to use Spring 6 and Java 17 #690

Closed
VictorCavichioli opened this issue Jul 9, 2024 · 5 comments
Closed

Upgrade ecChronos to use Spring 6 and Java 17 #690

VictorCavichioli opened this issue Jul 9, 2024 · 5 comments
Labels
bug Something isn't working enhancement New feature or request

Comments

@VictorCavichioli
Copy link
Contributor

Story Description:
As reported from Spring boot team, the CVE-2016-1000027 in Spring-web project will be fixed in Spring 6, which depends of the Java 17, so to fix the vulnerability we need to update both versions, Spring and JDK. The patch for JDK 17 was created few months ago in #617

For more informations about, follow the thread below:
spring-projects/spring-framework#24434

@VictorCavichioli VictorCavichioli added enhancement New feature or request bug Something isn't working labels Jul 9, 2024
@tommystendahl
Copy link
Collaborator

CVE-2016-1000027 was solved in #733

@jwaeab
Copy link
Collaborator

jwaeab commented Oct 15, 2024

So even though #733 "only" stepped to a higher version 5, the fix is in place? Should we close this then?

@tommystendahl
Copy link
Collaborator

When CVE-2016-1000027 was raised Springboot had declared v5 EOL and had no intention of releasing a fix for v5, later it seams they changed there mind and released a new v5 anyway.
But we still need to move to java17 and step springboot to v6 for #704 but maybe we can close this and do everything in #704.

@jwaeab
Copy link
Collaborator

jwaeab commented Oct 15, 2024

I vote for moving it into #704 instead :)

@jwaeab
Copy link
Collaborator

jwaeab commented Oct 15, 2024

This will be a part of #704 so this will be closed - as a duplicate.

@jwaeab jwaeab closed this as not planned Won't fix, can't repro, duplicate, stale Oct 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

3 participants