fix(deps): update dependency org.springframework.security:spring-security-web to v5 [security] #30
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
…rity-web to v5 [security]
renovate
bot
force-pushed
the
renovate/maven-org.springframework.security-spring-security-web-vulnerability
branch
from
bead1ba
to
fb39c6f
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.1.3.RELEASE->5.4.11GitHub Vulnerability Alerts
CVE-2021-22112
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
CVE-2022-22978
In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with
.in the regular expression are possibly vulnerable to an authorization bypass.Release Notes
spring-projects/spring-security (org.springframework.security:spring-security-web)
v5.4.11Compare Source
v5.4.10Compare Source
🪲 Bug Fixes
com.nimbusds.jwt.proc.JWTProcessordoes not have asetJWTClaimSetJWSKeySelectormethod #10521v5.4.9Compare Source
⭐ New Features
mockJwt()andjwt()#10266🪲 Bug Fixes
loginProcessingUrlwithout{registrationId}when providing anAuthenticationConverter#10342🔨 Dependency Upgrades
v5.4.8Compare Source
⭐ New Features
🪲 Bug Fixes
🔨 Dependency Upgrades
v5.4.7Compare Source
⭐ New Features
🪲 Bug Fixes
v5.4.6Compare Source
🪲 Bug Fixes
🔨 Dependency Upgrades
v5.4.5Compare Source
🪲 Bug Fixes
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
v5.4.4Compare Source
This release fixes a problem with the release of 5.4.3
⭐ New Features
🪲 Bug Fixes
🔨 Dependency Upgrades
v5.4.3Compare Source
⭐ New Features
🪲 Bug Fixes
🔨 Dependency Upgrades
v5.4.2Compare Source
⭐ New Features
🪲 Bug Fixes
🔨 Dependency Upgrades
v5.4.1Compare Source
⭐ New Features
🪲 Bug Fixes
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
v5.4.0Compare Source
⭐ New Features
🪲 Bug Fixes
🔨 Dependency Upgrades
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
v5.3.13.RELEASECompare Source
🪲 Bug Fixes
com.nimbusds.jwt.proc.JWTProcessordoes not have asetJWTClaimSetJWSKeySelectormethod #10522🔨 Dependency Upgrades
v5.3.12.RELEASECompare Source
⭐ New Features
mockJwt()andjwt()#10267🪲 Bug Fixes
🔨 Dependency Upgrades
v5.3.11.RELEASECompare Source
⭐ New Features
🪲 Bug Fixes
🔨 Dependency Upgrades
v5.3.10.RELEASECompare Source
⭐ New Features
🪲 Bug Fixes
v5.3.9.RELEASECompare Source
🪲 Bug Fixes
🔨 Dependency Upgrades
v5.3.8.RELEASECompare Source
This release fixes a problem with the release of 5.3.7.
⭐ New Features
🪲 Bug Fixes
v5.3.7.RELEASECompare Source
⭐ New Features
🪲 Bug Fixes
v5.3.6.RELEASECompare Source
🪲 Bug Fixes
🔨 Dependency Upgrades
v5.3.5.RELEASECompare Source
🪲 Bug Fixes
🔨 Dependency Upgrades
v5.3.4.RELEASECompare Source
⭐ New Features
🪲 Bug Fixes
🔨 Dependency Upgrades
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
v5.3.3.RELEASECompare Source
⭐ New Features
🪲 Bug Fixes
🔨 Dependency Upgrades
v5.3.2.RELEASECompare Source
⭐ New Features
🪲 Bug Fixes
🔨 Dependency Upgrades
v5.3.1.RELEASECompare Source
⭐ New Features
ServerBearerExchangeFilterFunction#8221🪲 Bug Fixes
❤️ Contributors
We'd like to thank all the contributors who worked on this release!
v5.3.0.RELEASECompare Source
⭐ New Features
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.