search

opensrp / hapi-fhir-jpaserver-starter

Apache License 2.0
0 stars 1 forks source link

Upgrade Spring Framework version to fix Spring Vulnerability #42

Open rehammuzzamil opened 2 years ago

rehammuzzamil commented 2 years ago

https://spring.io/blog/2022/04/13/spring-framework-data-binding-rules-vulnerability-cve-2022-22968

Update Spring Version to 5.3.19

cc: @dubdabasoduba @f-odhiambo

rehammuzzamil commented 2 years ago

Observations: I see the HAPI team has worked on a fix under release 1.1.4.HAPI FHIR 6.0.1 (Tanuki) . It was released on Released: 2022-05-25.

image (3)

In my opinion,it would definitely be a part of the quarterly release by the HAPI team, which is expected to be on 2022-08-18 by the name of HAPI FHIR 6.1.0 (TBD). For more context, please refer to https://hapifhir.io/hapi-fhir/docs/introduction/changelog.html

Please let me know your thoughts on this @dubdabasoduba . cc : @f-odhiambo @ageryck

dubdabasoduba commented 2 years ago

I think this makes sense. Do we have PRs fixing the same on our extension & keycloak repo?

rehammuzzamil commented 2 years ago

I will share PRs when done.