Spring Framework security defect

[Jackson, Douglas]

Hi!
There seems to be a security defect against the Spring Framework used by karaf 
4.2.9. In order to avoid it, we would need to upgrade to 5.2.9 of the spring 
framework.
Would it be possible to replace the spring framework in karaf 4.2.9 with the 
5.2.9 version (i.e. modify the spring feature file to refer to the newer 
version).
If not, are there plans to upgrade the spring version in karaf 4.2.10 by any 
chance?
Thanks,
Doug