[NIFI-13933] Upgrade Spring Security to 6.3.4 and Address Dependency Check Findings

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.0
• Component/s: Core Framework
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 26/Oct/24 15:29
• Updated: 26/Oct/24 21:19
• Resolved: 26/Oct/24 21:19

Description

Spring Security dependencies should be upgraded to 6.3.4 to address findings for CVE-2024-38821. This vulnerability applies to WebFlux libraries that NiFi does not use.

In addition, recent Dependency Check Plugin reports include a number of false positives related to Azure Identity libraries. False positives should be suppressed and other impacted dependencies should be upgraded.

Issue Links

• links to: GitHub Pull Request #9450