Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ehcache - OWASP Dependency Check issues [SWS-1033] #1102

Closed
gregturn opened this issue Aug 28, 2018 · 3 comments
Closed

Ehcache - OWASP Dependency Check issues [SWS-1033] #1102

gregturn opened this issue Aug 28, 2018 · 3 comments

Comments

@gregturn
Copy link
Member

@gregturn gregturn commented Aug 28, 2018

Petr Dvorak opened SWS-1033 and commented

We have recently updated to Spring Boot 2.0.4 (currently the latest version) and our automatic testing has detected a big increase of issue count while checking dependencies (Jenkins Plugin for "OWASP Dependency Check").

!Screen Shot 2018-08-28 at 18.33.57.png|width=484,height=362!

The main "troublemaker" seems to be the Ehcache library that is available as a dependency in the current version of the Spring WS-Security (3.0.3).

!image.png|width=468,height=253!

Could you please have a look at the library, and give us a hint if it is secure to exclude it?


Affects: 3.0.3

Attachments:

Referenced from: commits 40c8447, 738eb70

Backported to: 2.4.3

@gregturn
Copy link
Member Author

@gregturn gregturn commented Aug 31, 2018

Petr Dvorak commented

Hello, we managed to work around the issue with following Maven exclusions:

<dependency>
    <groupId>org.springframework.ws</groupId>
    <artifactId>spring-ws-security</artifactId>
    <exclusions>
        <exclusion>
            <artifactId>ehcache</artifactId>
            <groupId>net.sf.ehcache</groupId>
        </exclusion>
        <exclusion>
            <artifactId>geronimo-javamail_1.4_mail</artifactId>
            <groupId>org.apache.geronimo.javamail</groupId>
        </exclusion>
    </exclusions>
</dependency>
@gregturn
Copy link
Member Author

@gregturn gregturn commented Sep 12, 2018

Greg Turnquist commented

I'm introducing SpringBasedX509UserCache, which lets users migrate away from EhCache and toward Spring Framework's cache abstraction.

EhCacheBasedX509UserCache is deprecated, meaning in a future, major release, we'll be able to remove EhCache from the list of dependencies. For now, if you're not using it, you can simply exclude it as a dependency.

@gregturn
Copy link
Member Author

@gregturn gregturn commented Sep 13, 2018

Petr Dvorak commented

Greg Turnquist Thank you, Greg.

@gregturn gregturn closed this Sep 13, 2018
@gregturn gregturn added this to the 3.0.4 milestone Sep 22, 2020
@gregturn gregturn self-assigned this Sep 22, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
1 participant