CVE-2016-1000027 SonaType finding with 5.3.27

[aravindhan3112]

Affects: Spring v5.3.27

---

Currently we are using JDK 1.8 and Spring v5.3.27 and our application have few dependencies on the library upgrade to 6.x as per recommendation as it required JDK upgrade as well. Is there any workaround that we can get which is compatible with JDK1.8 or any other minor release version which we can use to remediate this issue.

[bclozel]

Please search for issues before submitting a new one, there are plenty of duplicates for this already.

See the following comment.

[aravindhan3112]

Hi @bclozel we looked for few relevant issues, but we are looking for a way which we can either look up for compatibility with JDK 1.8 and non vulnerable version. Can we get a reference ticket more relevant to our use case

[bclozel]

This is the most relevant ticket. Please read the comment I've linked to in my previous message.

[aravindhan3112]

Thanks for your quick support.