Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix dependency vulnerabilities of the configuration-server in v2.2.0 #1553

Closed
heiko-holz opened this issue Dec 9, 2022 · 0 comments · Fixed by #1554
Closed

Fix dependency vulnerabilities of the configuration-server in v2.2.0 #1553

heiko-holz opened this issue Dec 9, 2022 · 0 comments · Fixed by #1554
Assignees
@quandor
Labels
area/general

Comments

@heiko-holz
Copy link
Contributor

heiko-holz commented Dec 9, 2022 •
edited

The configuration-server of the current release (v2.2.0) has various security-high and risk in its dependencies, e.g.,

com.fasterxml.jackson.core : jackson-databind : 2.13.1
org.apache.tomcat.embed : tomcat-embed-core : 8.5.46
org.springframework : spring-beans : 5.3.14
org.yaml : snakeyaml : 1.30

In this issue, these dependencies (also transitively) need to be updated so that we do not have any vulnerabilities in the configuration server.
heiko-holz pushed a commit to heiko-holz/inspectit-ocelot that referenced this issue Dec 9, 2022
fix(dependencies): upgrade snakeyaml, logback, and jacksondatabind [i…
b72360d 
…nspectIT#1553]
@heiko-holz heiko-holz mentioned this issue Dec 9, 2022
Merged
@heiko-holz heiko-holz changed the title Update dependencies to fix vulnerabilities for v2.2.0 Fix dependency vulnerabilities in v2.2.0 Dec 9, 2022
heiko-holz pushed a commit to heiko-holz/inspectit-ocelot that referenced this issue Dec 9, 2022
fix(dependencies): adjust spring-boot-test version [inspectIT#1553]
c6cceb4
heiko-holz pushed a commit to heiko-holz/inspectit-ocelot that referenced this issue Dec 9, 2022
fix(dependencies): adjust spring-beans version in configuration-server [
555a159 
inspectIT#1553]
heiko-holz pushed a commit to heiko-holz/inspectit-ocelot that referenced this issue Dec 9, 2022
fix(dependencies): upgrade snakeyaml, logback, and jacksondatabind [i…
aa8f747 
…nspectIT#1553]
heiko-holz pushed a commit to heiko-holz/inspectit-ocelot that referenced this issue Dec 9, 2022
fix(dependencies): adjust spring-boot-test version [inspectIT#1553]
29205b9
heiko-holz pushed a commit to heiko-holz/inspectit-ocelot that referenced this issue Dec 9, 2022
fix(dependencies): adjust spring-beans version in configuration-server [
df49fb7 
inspectIT#1553]
heiko-holz pushed a commit to heiko-holz/inspectit-ocelot that referenced this issue Dec 9, 2022
fix(dependencies): fix dependencies for configdocsgenerator [inspectI…
2ab92a5 
…T#1553]
heiko-holz pushed a commit to heiko-holz/inspectit-ocelot that referenced this issue Dec 14, 2022
fix(dependencies): upgrade commons-text to v1.10 [inspectIT#1553]
30d2689
heiko-holz pushed a commit to heiko-holz/inspectit-ocelot that referenced this issue Dec 14, 2022
fix(dependencies): increase CycloneDX BOM schemaVersion to v1.4 [insp…
7da57c3 
…ectIT#1553]
heiko-holz pushed a commit to heiko-holz/inspectit-ocelot that referenced this issue Dec 14, 2022
fix(dependencies): upgrade jackson-databind [inspectIT#1553]
de807e5
@quandor quandor self-assigned this Dec 20, 2022
heiko-holz pushed a commit to heiko-holz/inspectit-ocelot that referenced this issue Dec 21, 2022
fix(swagger): sort schemas alphabetically in swagger-ui [inspectIT#1553]
3fb0a8d
quandor added a commit that referenced this issue Dec 21, 2022
@quandor
Closes #1553: Fix dependency vulnerabilities in v2.2.0 (#1554)
b61326f 
* fix(dependencies): upgrade snakeyaml, logback, and jacksondatabind [#1553]

* fix(dependencies): adjust spring-boot-test version [#1553]

* fix(dependencies): adjust spring-beans version in configuration-server [#1553]

* fix(dependencies): fix dependencies for configdocsgenerator [#1553]

* fix(dependencies): upgrade snakeyaml, logback, and jacksondatabind [#1553]

* fix(dependencies): adjust spring-beans version in configuration-server [#1553]

* fix(dependencies): add  owasp dependency check plugin

* fix(dependencies): upgrade commons-text to v1.10 [#1553]

* fix(dependencies): increase CycloneDX BOM schemaVersion to v1.4 [#1553]

* fix(dependencies): upgrade gson [#1533]

* fix(dependencies): upgrade jackson-databind [#1553]

* fix(dependencies): upgrade spring-boot and spring in configserver [#1533]

* fix(dependencies): migrate from SpringFox to openapi [#1533]

* Allow anonymous access to Swagger file

* Some Dependency upgrades

* No jacksonDatabindVersion necessary anymore

* Help if configuration server ui does not start

* Noch mehr Verbesserungen

* Weitere kleine Verbesserung

* Correct THIRD-PARTY-LICENSES.txt

* Example values included for API-Documentation

* Explains why some paths are excluded from security

* Removes unused dependency

* Removes unnecessary version info

Version depends on versions from included projects

* Fixes failing test

A version upgrade of Mockito caused this. Newer versions do know the
return type of java.time.Duration and return 0s instead of null. Hence
the assert broke.
Since the author did not understand the reason to use a mock, we
switched to a real object instead.

* Unify jUnit and mockito version

At least for some projects

* Reintroduces prematurely removed version info.

But aligned via properties with other projects.

* Removes unused gradle.properties in module directory

* Reverts an unintentional change

* Removes spring-boot-managed dependency versions

* Removes TODO after discussing

* No version for REST-Api

* fix(swagger): sort schemas alphabetically in swagger-ui [#1553]

* Comment about how dependency versions are resolved

* Uses current version of OWASP plugin

Co-Authored-By: Jochen Just <jochen.just@novatec-gmbh.de>
@heiko-holz heiko-holz changed the title Fix dependency vulnerabilities in v2.2.0 Fix dependency vulnerabilities of the configuration-server in v2.2.0 Dec 22, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@quandor quandor

Labels
area/general
Projects
None yet
Milestone
No milestone
2 participants
@quandor @heiko-holz