Skip to content

Commit

Permalink
CVE-2023-46589: Update tomcat (and spring) versions (#631)
Browse files Browse the repository at this point in the history
  • Loading branch information
labkey-susanh authored Nov 30, 2023

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
1 parent 3c58299 commit c804050
Showing 2 changed files with 20 additions and 3 deletions.
17 changes: 17 additions & 0 deletions dependencyCheckSuppression.xml
Original file line number Diff line number Diff line change
@@ -1,5 +1,22 @@
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">

<!-- We do not include logback with our embedded tomcat distributions -->
<suppress>
<notes><![CDATA[
file name: logback-classic-1.2.12.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback\-classic@.*$</packageUrl>
<vulnerabilityName>CVE-2023-6378</vulnerabilityName>
</suppress>
<suppress>
<notes><![CDATA[
file name: logback-core-1.2.12.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback\-core@.*$</packageUrl>
<vulnerabilityName>CVE-2023-6378</vulnerabilityName>
</suppress>

<!-- Prevent match against unrelated "rengine" at https://github.com/yogeshojha/rengine -->
<suppress>
<notes><![CDATA[
6 changes: 3 additions & 3 deletions gradle.properties
Original file line number Diff line number Diff line change
@@ -100,7 +100,7 @@ apacheDirectoryVersion=2.1.3
apacheMinaVersion=2.2.1

# Keep in sync with springBootTomcatVersion below
apacheTomcatVersion=9.0.82
apacheTomcatVersion=9.0.83

# (mothership) -> json-path -> json-smart -> accessor-smart
# (core) -> graalvm
@@ -276,10 +276,10 @@ slf4jLog4jApiVersion=2.0.7
# This is a dependency for HTSJDK. Force to avoid a deserialization problem. Remove once HTSJDK bumps its preferred version
snappyJavaVersion=1.1.10.4

springBootVersion=2.7.17
springBootVersion=2.7.18
# This MUST match the Tomcat version dictated by springBootVersion
# Also, keep this in sync with apacheTomcatVersion above
springBootTomcatVersion=9.0.82
springBootTomcatVersion=9.0.83

springVersion=5.3.28

0 comments on commit c804050

Please sign in to comment.