OHDSI / WebAPI

OHDSI WebAPI contains all OHDSI services that can be called from OHDSI applications
Apache License 2.0
130 stars 169 forks source link

Critical Vulnerabilities in Spring components picked up by Trivy scan #2410

Open Nic-Ed opened 1 week ago

Nic-Ed commented 1 week ago

Expected behavior

No vulnerabilities (especially high or critical severity ones) should be found on a Trivy scan

Actual behavior

Critical vulnerabilities are detected in Spring framework and other components. I'm aware of the closed issue here: https://github.com/OHDSI/WebAPI/issues/2298 and the fact the vulnerability only applies with JDK9+. This isn't really a satisfactory solution for us . Can you advise if there has been or will be a fix for this issue so that there are no critical or high severity vulnerabilities detected after scanning WebAPI installed from the latest release?