[NIFI-11478] Upgrade Spring Framework to 5.3.27 and Spring Security to 5.8.3

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.0-M1, 1.22.0
• Component/s: Core Framework, MiNiFi, NiFi Registry, Security
• Labels: dependency-upgrade
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 21/Apr/23 16:37
• Updated: 23/Apr/23 08:50
• Resolved: 23/Apr/23 08:50

Description

Spring Framework 5.3.26 and earlier contain a Spring Expression Language vulnerability described in CVE-2023-20863.

Spring Security 5.8.2 and earlier contain a Security Context logout vulnerability described in CVE-2023-20862.

Spring Framework 5.3.27 resolves CVE-2023-20863 and Spring Security 5.8.3 resolves CVE-2023-20862.

Spring Boot 2.7.11 incorporates these upgrades and should be updated for Registry.

Framework components do not use Spring Expression Language and do not use HTTP sessions for persisting Security Context information.

Issue Links

• links to: GitHub Pull Request #7190