[JIRA] (JENKINS-28687) spring version (2.5.x) is ancient and not compatable with many new libraries

[db...@cloudbees.com (JIRA)]

Title: Message Title

Daniel Beck commented on JENKINS-28687   Re: spring version (2.5.x) is ancient and not compatable with many new libraries Actually, you didn't explain they were false positives I didn't use this term, true. Still, quoting my previous response: crypto-util is a library by the Jenkins project. The CVE points to Erlang Open Telecom Platform and is pretty obviously unrelated and "SpringSource Spring Framework 2.5.x before 2.5.6.SEC02…" (and you can stop reading right there) and the class was introduced in Spring 3.0. You deflected and said it wasn't your problem.  … It's clearly out of date. Rather than attacking the requestor, could you address the request? The outdated component is clearly a problem. It is however not a problem in the way you brought up – having these security vulnerabilities. I'm not attacking you, I point out that what you wrote specifically doesn't look like a problem. As far as I'm concerned (and since you keep bringing up my employer in an unrelated issue tracker, I'm not speaking on behalf of CloudBees), it's simply a matter of effort to benefit. It's almost certain that many plugins will break and require adaptation. And "not getting false positive security scanner findings" isn't the kind of benefit I would want to see for months of effort. In fact, if the issue description is correct and we'd have to update Groovy, it would almost certainly introduce new security vulnerabilities (via Script Security). Add Comment   This message was sent by Atlassian Jira (v7.13.12#713012-sha1:6e07c38) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.163136.1433239556000.3676.1585666500474%40Atlassian.JIRA.