Closed bladyzamosc closed 1 day ago
@moarychan @netyyyy @rujche @saragluna
Thank you for your feedback. Tagging and routing to the team member best able to assist.
Hi, @bladyzamosc .
Thanks for reaching out.
In Spring Cloud Azure, the external dependencies' versions are align with Spring Boot.
spring-cloud-azure-starter-keyvault-secrets : 5.14.0
depends on io.netty : netty-handler : 4.1.111.final
, because spring-cloud-azure-starter-keyvault-secrets : 5.14.0
is align with Spring Boot 3.3.1. And spring-boot-dependencies:3.3.1
's netty version is 4.1.111.final.
To solve the vulnerabilities in your project, you can add dependency version manually like this:
<dependencies>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-handler</artifactId>
<version>xxx</version>
</dependency>
</dependencies>
Hi @bladyzamosc. Thank you for opening this issue and giving us the opportunity to assist. To help our team better understand your issue and the details of your scenario please provide a response to the question asked above or the information requested above. This will help us more accurately address your issue.
Hi @bladyzamosc, we're sending this friendly reminder because we haven't heard back from you in 7 days. We need more information about this issue to help address it. Please be sure to give us your input. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!
Hello. I am kindly asking for help in solving the problem.
Part of the hierarchy of the spring-cloud-azure-starter-keyvault-secrets looks like this:
Report description - Security vulnerability sonatype-2020-0026:
Expected behavior
Removing the problem at the level of the spring-cloud-azure-starter-keyvault-secrets library, or proposing another solution to the problem using this library.
Screenshots
Setup
Additional context This issue is important for security reasons. In my case, spring-cloud-azure-starter-keyvault-secrets is used in many projects and replacing it with another solution will be extremely expensive or not entirely possible.