[
https://issues.apache.org/jira/browse/DIRMINA-1182?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17893353#comment-17893353
]
Johnnie White commented on DIRMINA-1182:
----------------------------------------
It's sounds good that changes have been committed, *but why not directly
approval?*
And what's more bothering you? *Also fix 2.0.X like 2.2.X?* Still have a
problem like [~yuanhuahan] pointed, if update Spring, the code may not support
Java8, though I can let the code without compatibility bug. But we cannot
contorll execution environment, maybe release 2.4.X to embrace Java8+ ?
I need to know *what's the plan* to facing between old java version's
vulnerability risk and execution compatibility.( Or we could split mina-example
& mina-integreation-xbeans out)
> Is there any plan to fix the dependent vulnerabilities of Spring Framework
> 2.5.6.SEC03?
> ---------------------------------------------------------------------------------------
>
> Key: DIRMINA-1182
> URL: https://issues.apache.org/jira/browse/DIRMINA-1182
> Project: MINA
> Issue Type: Wish
> Affects Versions: 2.2.3, 2.1.8
> Reporter: Yuanhua Han
> Priority: Major
> Fix For: 2.2.4, 2.0.27, 2.1.10
>
> Attachments: image-2024-10-08-22-47-47-371.png,
> image-2024-10-08-22-49-52-441.png, image-2024-10-08-22-54-11-235.png,
> image-2024-10-28-10-53-37-111.png, image-2024-10-28-10-54-19-751.png
>
>
> Hello, we found that Apache MINA 2.2.3 and 2.1.8 both depends on spring
> 2.5.6.SEC03(corresponding to Spring Framework software), which is a very old
> version (released on Sep 09, 2011) and has been EOL and also can not find
> source code package.
> It seems that spring 2.5.6.SEC03 have some vulnerabilities(this artifact was
> moved to spring-core and spring-core 2.5.6.SEC03 have vulnerabilities).
> [https://mvnrepository.com/artifact/org.springframework/spring]
> !image-2024-10-08-22-47-47-371.png!
> [https://mvnrepository.com/artifact/org.springframework/spring-core/2.5.6.SEC03]
> !image-2024-10-08-22-54-11-235.png!
> Does these vulnerability affect Apache MINA? If yes, can I ask if there are
> any plans of Apache MINA community to adapt to the new version of Spring
> Framework to fix these vulnerabilities?
> Thanks.
> The detailed dependencies are as follows:
> mina-integration-xbean 2.2.3/2.1.8 ---> spring 2.5.6.SEC03
> mina-example 2.2.3/2.1.8 ---> spring 2.5.6.SEC03
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@mina.apache.org
For additional commands, e-mail: dev-h...@mina.apache.org
