DMC/scipro
7
0
Fork 0
Code Issues 31 Pull Requests 2 Actions Projects 1 Wiki Activity

CVE-2024-45801 #80

New Issue
Closed
opened 2025-01-16 11:41:52 +01:00 by ansv7779 · 3 comments
ansv7779 commented 2025-01-16 11:41:52 +01:00
Owner
Copy Link
No description provided.
ansv7779 added the
new
 label 2025-01-16 11:41:56 +01:00
andan removed the
new
 label 2025-01-16 13:25:20 +01:00
andan added this to the SciPro project 2025-01-16 13:38:56 +01:00
andan moved this to Backlog in SciPro on 2025-01-22 14:50:55 +01:00
niat8586 moved this to Doing in SciPro on 2025-01-23 06:15:59 +01:00
niat8586 self-assigned this 2025-01-23 06:16:20 +01:00
niat8586 commented 2025-01-23 07:07:08 +01:00
Owner
Copy Link

Our current version of sprindoc-openapi-starter-webmvc (2.5.0 ) has a depeedency on swagger-ui (5.13.0).
Swagger-ui is using DOMPurify.

+- org.springdoc:springdoc-openapi-starter-webmvc-ui:jar:2.5.0:compile
| +- org.springdoc:springdoc-openapi-starter-webmvc-api:jar:2.5.0:compile
| | - org.springdoc:springdoc-openapi-starter-common:jar:2.5.0:compile
| | - io.swagger.core.v3:swagger-core-jakarta:jar:2.2.21:compile
| | +- org.apache.commons:commons-lang3:jar:3.13.0:compile
| | +- io.swagger.core.v3:swagger-annotations-jakarta:jar:2.2.21:compile
| | +- io.swagger.core.v3:swagger-models-jakarta:jar:2.2.21:compile
| | +- jakarta.validation:jakarta.validation-api🫙3.0.2:compile
| | - com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.15.4:compile
| - org.webjars:swagger-ui:jar:5.13.0:compile

The vurnability in the DOMPurify code was fixed mid May 2024.
Updating our springdoc-openapi-starter-webmvc we would also get the latest version for swagger-ui.

Our current version of sprindoc-openapi-starter-webmvc (2.5.0 ) has a depeedency on swagger-ui (5.13.0). Swagger-ui is using DOMPurify. +- org.springdoc:springdoc-openapi-starter-webmvc-ui:jar:2.5.0:compile | +- org.springdoc:springdoc-openapi-starter-webmvc-api:jar:2.5.0:compile | | \- org.springdoc:springdoc-openapi-starter-common:jar:2.5.0:compile | | \- io.swagger.core.v3:swagger-core-jakarta:jar:2.2.21:compile | | +- org.apache.commons:commons-lang3:jar:3.13.0:compile | | +- io.swagger.core.v3:swagger-annotations-jakarta:jar:2.2.21:compile | | +- io.swagger.core.v3:swagger-models-jakarta:jar:2.2.21:compile | | +- jakarta.validation:jakarta.validation-api:jar:3.0.2:compile | | \- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.15.4:compile | \- org.webjars:swagger-ui:jar:5.13.0:compile The vurnability in the DOMPurify code was fixed mid May 2024. Updating our springdoc-openapi-starter-webmvc we would also get the latest version for swagger-ui.
niat8586 commented 2025-01-23 09:30:08 +01:00
Owner
Copy Link

According to the compability matrix found here we need to upgrade spring boot to 3.4.x as well to be able to use the latest version of springdoc-openapi-starter.

According to the compability matrix found [here](https://springdoc.org/#what-is-the-compatibility-matrix-of-springdoc-openapi-with-spring-boot) we need to upgrade spring boot to 3.4.x as well to be able to use the latest version of springdoc-openapi-starter.
niat8586 moved this to Review in SciPro on 2025-01-23 10:16:54 +01:00
niat8586 removed their assignment 2025-01-23 10:17:22 +01:00
ansv7779 commented 2025-01-23 20:50:49 +01:00
Author
Owner
Copy Link

Fixed by #91

Fixed by #91
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
discussion
duplicate
This issue or pull request already exists
enhancement
New feature
frozen
The issue is not solved, but it will be investigated in the future it the issue arises again
help wanted
Need some help
invalid
Something is wrong
new
To be discussed at the next meeting
po
approved
po
needed
question
More information is needed
size
1
size
2
size
3
wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project SciPro
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DMC/scipro#80
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?