[HDDS-10815] Bump Spring Framework to 5.3.34

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Done
• Fix Version/s: 1.5.0
• Component/s: build
• Labels: pull-request-available
• Target Version/s: 1.5.0, 1.4.1
• Assignee: Rohit Kumar
• Reporter: Rohit Kumar
• Created: 06/May/24 08:44
• Updated: 06/May/24 12:56
• Resolved: 06/May/24 12:06

Description

Upgrade Spring Framework to 5.3.34 due to CVE-2024-22243, CVE-2024-22259 and CVE-2024-22262

CVE-2024-22243:- Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation checks.
https://spring.io/security/cve-2024-22243 
https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6261586 

CVE-2024-22262:- Affected versions of this package are vulnerable to Open Redirect when UriComponentsBuilder is used to parse an externally provided URL and perform validation checks on the host of the parsed URL.
https://spring.io/security/cve-2024-22262 
https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6597980 

CVE-2024-22259:- Affected versions of this package are vulnerable to Open Redirect when using UriComponentsBuilder to parse an externally provided URL and perform validation checks on the host of the parsed URL.
https://spring.io/security/cve-2024-22259 
https://security.snyk.io/vuln/SNYK-JAVA-ORGSPRINGFRAMEWORK-6444790 

Issue Links

• links to: GitHub Pull Request #6643