[CAMEL-9402] Upgrade Spring Dependency to 4.1.9.RELEASE or later

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.16.1
• Fix Version/s: 2.16.2, 2.17.0
• Estimated Complexity: Unknown
• Assignee: Claus Ibsen
• Reporter: Mark Symons
• Created: 09/Dec/15 13:02
• Updated: 25/Dec/15 09:58
• Resolved: 25/Dec/15 09:58

Description

Camel 2.16.1 has dependencies on spring 4.1.8.RELEASE

This is causing Sonatype Nexus Pro reports to identify a level 9 threat (See "foxglove" link) against artifact spring-core used in Camel.

Upgrade dependency to 4.2.3.RELEASE (see linked SPR issue).

Issue Links

• links to: Spring Framework: SerializableTypeWrapper.MethodInvokeTypeProvider can be exploited for unsafe deserialization
• links to: What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability.