search

spring-cloud / spring-cloud-release

Spring Cloud Release Train - dependency management across a wide range of Spring Cloud projects.
http://projects.spring.io/spring-cloud
Apache License 2.0
874 stars 179 forks source link

2021.0.x release for cve-2022-22965 #242

Closed galvo closed 2 years ago

galvo commented 2 years ago

Describe the bug Will there be a 2021.0.x release for cve-2022-22965 and https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement, it looks like there will be based on the latest commit to this branch, interested to know if you have a timeline on when this could be made available?

Many Thanks

Sample If possible, please provide a test case or sample application that reproduces the problem. This makes it much easier for us to diagnose the problem and to verify that we have fixed it.

marcingrzejszczak commented 2 years ago

Spring Cloud does not manage Spring version. It comes from Spring Boot. It's enough for you to upgrade your Spring Boot version.

galvo commented 2 years ago

The spring boot version used is driven from this right? https://github.com/spring-cloud/spring-cloud-release/blob/1afd865c144737764f64776e82c1f73558f72193/spring-cloud-starter-parent/pom.xml#L8

spencergibb commented 2 years ago

Only for building. If you go to https://start.spring.io you'll see that the boot version is managed independently for users of spring cloud