Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Review and update spring cloud functions dependency for CVE #929

Closed
salaboy opened this issue Mar 31, 2022 · 1 comment · Fixed by #936
Closed

Review and update spring cloud functions dependency for CVE #929

salaboy opened this issue Mar 31, 2022 · 1 comment · Fixed by #936
Assignees
@lance @salaboy

Comments

@salaboy
Copy link
Member

salaboy commented Mar 31, 2022

@salaboy salaboy self-assigned this Mar 31, 2022
@lance lance moved this to Icebox (backlog and controversial items) in Func Roadmap Mar 31, 2022
@lance
Copy link
Member

lance commented Apr 1, 2022 •
edited
Loading

The dependency that is used by the templates is spring-cloud-dependencies version 2021.0.1. This is an umbrella dependency that just pulls in a bunch of other dependencies. Reading this blog post about the issue, we are affected by “Information Exposure in Spring Cloud Function”, with a mitigation by a bump to spring-cloud-functions to 3.2.3 or higher. It appears to me that spring-cloud-dependencies has already made that bump based on my reading of this. https://mvnrepository.com/artifact/org.springframework.cloud/spring-cloud-dependencies/2021.0.1

If this is all true, then I think we are good and function users should not be affected. I would like for someone with more recent Java experience to validate these findings, however, as it’s been years and my Java fu is rusty.

Well, I just created a new springboot function project and when building it, the older 3.2.2 version of spring-cloud-functions was used. So, it seems that we need to explicitly include the fix version

Downloading from spring-releases: https://repo.spring.io/release/org/springframework/cloud/spring-cloud-function-dependencies/3.2.2/spring-cloud-function-dependencies-3.2.2.pom
Downloaded from spring-releases: https://repo.spring.io/release/org/springframework/cloud/spring-cloud-function-dependencies/3.2.2/spring-cloud-function-dependencies-3.2.2.

/cc @trisberg

@lance lance self-assigned this Apr 1, 2022
lance added a commit to lance/func that referenced this issue Apr 1, 2022
@lance
fix: apply updated spring-boot-function dependency
0a5c898 
This commit updates the spring-boot-function dependency explicitly as there
is not yet a CVE fix for spring-cloud 2021.0.1.

```
❯ ./mvnw clean install dependency:tree | grep spring-cloud-function
[INFO] |  +- org.springframework.cloud:spring-cloud-function-web:jar:3.2.2:compile
[INFO] +- org.springframework.cloud:spring-cloud-function-context:jar:3.2.3:compile (optional)
[INFO] |  +- org.springframework.cloud:spring-cloud-function-core:jar:3.2.2:compile (optional)
```

Fixes: knative#929
Fixes: https://spring.io/blog/2022/03/29/cve-report-published-for-spring-cloud-function

Signed-off-by: Lance Ball <lball@redhat.com>
@lance lance mentioned this issue Apr 1, 2022
Merged
knative-prow bot pushed a commit that referenced this issue Apr 4, 2022
@lance
fix: apply updated spring-boot-function dependency (#936)
4a4cebb 
This commit updates the spring-boot-function dependency explicitly as there
is not yet a CVE fix for spring-cloud 2021.0.1.

```
❯ ./mvnw clean install dependency:tree | grep spring-cloud-function
[INFO] |  +- org.springframework.cloud:spring-cloud-function-web:jar:3.2.2:compile
[INFO] +- org.springframework.cloud:spring-cloud-function-context:jar:3.2.3:compile (optional)
[INFO] |  +- org.springframework.cloud:spring-cloud-function-core:jar:3.2.2:compile (optional)
```

Fixes: #929
Fixes: https://spring.io/blog/2022/03/29/cve-report-published-for-spring-cloud-function

Signed-off-by: Lance Ball <lball@redhat.com>
Repository owner moved this from Icebox (backlog and controversial items) to In Design (typically large tasks with a feature track) in Func Roadmap Apr 4, 2022
lance added a commit to lance/func that referenced this issue Apr 4, 2022
@lance
fix: apply updated spring-boot-function dependency (knative#936)
d75b388 
This commit updates the spring-boot-function dependency explicitly as there
is not yet a CVE fix for spring-cloud 2021.0.1.

```
❯ ./mvnw clean install dependency:tree | grep spring-cloud-function
[INFO] |  +- org.springframework.cloud:spring-cloud-function-web:jar:3.2.2:compile
[INFO] +- org.springframework.cloud:spring-cloud-function-context:jar:3.2.3:compile (optional)
[INFO] |  +- org.springframework.cloud:spring-cloud-function-core:jar:3.2.2:compile (optional)
```

Fixes: knative#929
Fixes: https://spring.io/blog/2022/03/29/cve-report-published-for-spring-cloud-function

Signed-off-by: Lance Ball <lball@redhat.com>
knative-prow bot pushed a commit that referenced this issue Apr 4, 2022
@lance
Cherry pick SpringBoot updates for Release 0.22 (#939)
ee245c1 
* fix: apply updated spring-boot-function dependency (#936)

This commit updates the spring-boot-function dependency explicitly as there
is not yet a CVE fix for spring-cloud 2021.0.1.

```
❯ ./mvnw clean install dependency:tree | grep spring-cloud-function
[INFO] |  +- org.springframework.cloud:spring-cloud-function-web:jar:3.2.2:compile
[INFO] +- org.springframework.cloud:spring-cloud-function-context:jar:3.2.3:compile (optional)
[INFO] |  +- org.springframework.cloud:spring-cloud-function-core:jar:3.2.2:compile (optional)
```

Fixes: #929
Fixes: https://spring.io/blog/2022/03/29/cve-report-published-for-spring-cloud-function

Signed-off-by: Lance Ball <lball@redhat.com>

* deps: add updated pkged.go

Signed-off-by: Lance Ball <lball@redhat.com>
lance added a commit to lance/func that referenced this issue Apr 4, 2022
@lance
fix: apply updated spring-boot-function dependency (knative#936)
0145a54 
This commit updates the spring-boot-function dependency explicitly as there
is not yet a CVE fix for spring-cloud 2021.0.1.

```
❯ ./mvnw clean install dependency:tree | grep spring-cloud-function
[INFO] |  +- org.springframework.cloud:spring-cloud-function-web:jar:3.2.2:compile
[INFO] +- org.springframework.cloud:spring-cloud-function-context:jar:3.2.3:compile (optional)
[INFO] |  +- org.springframework.cloud:spring-cloud-function-core:jar:3.2.2:compile (optional)
```

Fixes: knative#929
Fixes: https://spring.io/blog/2022/03/29/cve-report-published-for-spring-cloud-function

Signed-off-by: Lance Ball <lball@redhat.com>
openshift-merge-robot pushed a commit to openshift-knative/kn-plugin-func that referenced this issue Apr 4, 2022
@lance
fix: CVE 2022-22963 Serverless 1.21.0 (#119)
15431c3 
* fix: apply updated spring-boot-function dependency (#936)

This commit updates the spring-boot-function dependency explicitly as there
is not yet a CVE fix for spring-cloud 2021.0.1.

```
❯ ./mvnw clean install dependency:tree | grep spring-cloud-function
[INFO] |  +- org.springframework.cloud:spring-cloud-function-web:jar:3.2.2:compile
[INFO] +- org.springframework.cloud:spring-cloud-function-context:jar:3.2.3:compile (optional)
[INFO] |  +- org.springframework.cloud:spring-cloud-function-core:jar:3.2.2:compile (optional)
```

Fixes: knative#929
Fixes: https://spring.io/blog/2022/03/29/cve-report-published-for-spring-cloud-function

Signed-off-by: Lance Ball <lball@redhat.com>

* deps: add updated pkged.go

Signed-off-by: Lance Ball <lball@redhat.com>

* deps: add updated pkged.go

Signed-off-by: Lance Ball <lball@redhat.com>
@lance lance moved this from In Design (typically large tasks with a feature track) to Done in Func Roadmap Apr 5, 2022
salaboy pushed a commit to salaboy/kn-plugin-func that referenced this issue Apr 14, 2022
@lance @salaboy
fix: apply updated spring-boot-function dependency (knative#936)
0a5e453 
This commit updates the spring-boot-function dependency explicitly as there
is not yet a CVE fix for spring-cloud 2021.0.1.

```
❯ ./mvnw clean install dependency:tree | grep spring-cloud-function
[INFO] |  +- org.springframework.cloud:spring-cloud-function-web:jar:3.2.2:compile
[INFO] +- org.springframework.cloud:spring-cloud-function-context:jar:3.2.3:compile (optional)
[INFO] |  +- org.springframework.cloud:spring-cloud-function-core:jar:3.2.2:compile (optional)
```

Fixes: knative#929
Fixes: https://spring.io/blog/2022/03/29/cve-report-published-for-spring-cloud-function

Signed-off-by: Lance Ball <lball@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lance lance

@salaboy salaboy

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: apply updated spring-boot-function dependency lance/func
2 participants
@lance @salaboy