Skip to content

Commit 40f3766

Browse files
rishikunnath2747rishikunnath2747
committed
fix BlackDuck security risks: bump Spring Boot and override Netty/Bouncy Castle
- Upgrade spring-boot-starter-parent from 3.2.6 to 3.5.16 in multi-tenant apps (resolves transitive CVEs in Tomcat 10.1.x, Spring Framework 6.1.x, Spring Security 6.2/6.3, jackson-databind 2.15/2.17) - Upgrade spring.boot.version from 3.3.1 to 3.5.16 in single-tenant apps (resolves Spring Boot 3.3.1 CVEs and above transitive dependencies) - Add dependencyManagement overrides for Netty 4.2.15.Final (was 4.1.110.Final) - Add dependencyManagement overrides for Bouncy Castle 1.84 (was 1.78.1)
1 parent f56e35b commit 40f3766

4 files changed

Lines changed: 88 additions & 4 deletions

File tree

  • app
    • multi-tenant
      • central-space/cloud-cap-samples-java
      • personal-space/cloud-cap-samples-java
    • single-tenant

‎app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>org.springframework.boot</groupId>
88
<artifactId>spring-boot-starter-parent</artifactId>
9-
<version>3.2.6</version>
9+
<version>3.5.16</version>
1010
<relativePath/> <!-- lookup parent from repository -->
1111
</parent>
1212

@@ -72,6 +72,27 @@
7272
<version>4.0.0</version>
7373
</dependency>
7474

75+
<!-- Security: fix Netty CVEs (BlackDuck) -->
76+
<dependency>
77+
<groupId>io.netty</groupId>
78+
<artifactId>netty-bom</artifactId>
79+
<version>4.2.15.Final</version>
80+
<type>pom</type>
81+
<scope>import</scope>
82+
</dependency>
83+
84+
<!-- Security: fix Bouncy Castle CVEs (BlackDuck) -->
85+
<dependency>
86+
<groupId>org.bouncycastle</groupId>
87+
<artifactId>bcprov-jdk18on</artifactId>
88+
<version>1.84</version>
89+
</dependency>
90+
<dependency>
91+
<groupId>org.bouncycastle</groupId>
92+
<artifactId>bcpkix-jdk18on</artifactId>
93+
<version>1.84</version>
94+
</dependency>
95+
7596
</dependencies>
7697
</dependencyManagement>
7798

‎app/multi-tenant/personal-space/cloud-cap-samples-java/pom.xml‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>org.springframework.boot</groupId>
88
<artifactId>spring-boot-starter-parent</artifactId>
9-
<version>3.2.6</version>
9+
<version>3.5.16</version>
1010
<relativePath/> <!-- lookup parent from repository -->
1111
</parent>
1212

@@ -72,6 +72,27 @@
7272
<version>4.0.0</version>
7373
</dependency>
7474

75+
<!-- Security: fix Netty CVEs (BlackDuck) -->
76+
<dependency>
77+
<groupId>io.netty</groupId>
78+
<artifactId>netty-bom</artifactId>
79+
<version>4.2.15.Final</version>
80+
<type>pom</type>
81+
<scope>import</scope>
82+
</dependency>
83+
84+
<!-- Security: fix Bouncy Castle CVEs (BlackDuck) -->
85+
<dependency>
86+
<groupId>org.bouncycastle</groupId>
87+
<artifactId>bcprov-jdk18on</artifactId>
88+
<version>1.84</version>
89+
</dependency>
90+
<dependency>
91+
<groupId>org.bouncycastle</groupId>
92+
<artifactId>bcpkix-jdk18on</artifactId>
93+
<version>1.84</version>
94+
</dependency>
95+
7596
</dependencies>
7697
</dependencyManagement>
7798

‎app/single-tenant/central-space/demoapp/pom.xml‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
<!-- DEPENDENCIES VERSION -->
1919
<jdk.version>21</jdk.version>
2020
<cds.services.version>4.1.1</cds.services.version>
21-
<spring.boot.version>3.3.1</spring.boot.version>
21+
<spring.boot.version>3.5.16</spring.boot.version>
2222
<cds.install-cdsdk.version>8.0.2</cds.install-cdsdk.version>
2323

2424
<cds.install-node.downloadUrl>https://nodejs.org/dist/</cds.install-node.downloadUrl>
@@ -48,6 +48,27 @@
4848
<type>pom</type>
4949
<scope>import</scope>
5050
</dependency>
51+
52+
<!-- Security: fix Netty CVEs (BlackDuck) -->
53+
<dependency>
54+
<groupId>io.netty</groupId>
55+
<artifactId>netty-bom</artifactId>
56+
<version>4.2.15.Final</version>
57+
<type>pom</type>
58+
<scope>import</scope>
59+
</dependency>
60+
61+
<!-- Security: fix Bouncy Castle CVEs (BlackDuck) -->
62+
<dependency>
63+
<groupId>org.bouncycastle</groupId>
64+
<artifactId>bcprov-jdk18on</artifactId>
65+
<version>1.84</version>
66+
</dependency>
67+
<dependency>
68+
<groupId>org.bouncycastle</groupId>
69+
<artifactId>bcpkix-jdk18on</artifactId>
70+
<version>1.84</version>
71+
</dependency>
5172
</dependencies>
5273
</dependencyManagement>
5374

‎app/single-tenant/personal-space/demoapp/pom.xml‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
<!-- DEPENDENCIES VERSION -->
1919
<jdk.version>21</jdk.version>
2020
<cds.services.version>4.1.1</cds.services.version>
21-
<spring.boot.version>3.3.1</spring.boot.version>
21+
<spring.boot.version>3.5.16</spring.boot.version>
2222
<cds.install-cdsdk.version>8.0.2</cds.install-cdsdk.version>
2323

2424
<cds.install-node.downloadUrl>https://nodejs.org/dist/</cds.install-node.downloadUrl>
@@ -48,6 +48,27 @@
4848
<type>pom</type>
4949
<scope>import</scope>
5050
</dependency>
51+
52+
<!-- Security: fix Netty CVEs (BlackDuck) -->
53+
<dependency>
54+
<groupId>io.netty</groupId>
55+
<artifactId>netty-bom</artifactId>
56+
<version>4.2.15.Final</version>
57+
<type>pom</type>
58+
<scope>import</scope>
59+
</dependency>
60+
61+
<!-- Security: fix Bouncy Castle CVEs (BlackDuck) -->
62+
<dependency>
63+
<groupId>org.bouncycastle</groupId>
64+
<artifactId>bcprov-jdk18on</artifactId>
65+
<version>1.84</version>
66+
</dependency>
67+
<dependency>
68+
<groupId>org.bouncycastle</groupId>
69+
<artifactId>bcpkix-jdk18on</artifactId>
70+
<version>1.84</version>
71+
</dependency>
5172
</dependencies>
5273
</dependencyManagement>
5374

0 commit comments

Comments
 (0)