Lukasz Lenart created WW-5717:
---------------------------------
Summary: Address OWASP dependency-check finding in Spring
Framework (spring-core)
Key: WW-5717
URL: https://issues.apache.org/jira/browse/WW-5717
Project: Struts 2
Issue Type: Task
Reporter: Lukasz Lenart
The OWASP dependency-check run (the {{owasp-nvd-api}} profile, which is
configured with {{failBuildOnCVSS=0}} so it reports every CVE regardless of
severity) flags a vulnerability in Spring Framework's {{spring-core}}.
This is a dependency-hygiene item, independent of any current feature branch —
no source change introduced it; it stems from the pinned Spring version.
h3. Current Spring versions
* _main (7.x):_ {{spring.version}} = {{6.2.19}} (default), {{7.0.8}}
(jakartaee11 profile)
* _support/struts-6-x-x (6.x):_ {{spring.platformVersion}} = {{5.3.39}}
Both lines should be checked against the reported CVE, since they track
different Spring release lines.
h3. Resolution options
h1. _Upgrade_ Spring to the latest patch of its respective line (6.2.x / 7.0.x
on main, 5.3.x on 6.x) if the CVE is fixed upstream, and confirm the finding
clears.
h1. _Suppress_ the finding in the OWASP suppression file
({{src/etc/project-suppression.xml}}) if the CVE does not apply to how Struts
uses Spring (a common situation for dependency-check + Spring). The file
already curates such false positives; no Spring CVE is suppressed there today.
h3. Notes
* {{spring-core}} is not shipped by every module; e.g. the Tiles plugin only
pulls {{spring-test}} (test scope).
* The exact CVE id from the scan output should be recorded here to drive the
decision (upgrade vs. suppress) and to document the rationale if suppressed.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
