[RANGER-3691] Upgrade spring to 5.3.18 CVE-2022-22965

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 3.0.0, 2.3.0
• Component/s: admin, kms
• Assignee: kirby zhou
• Reporter: kirby zhou
• Created: 01/Apr/22 06:15
• Updated: 12/Apr/22 16:07
• Resolved: 04/Apr/22 07:21

Description

https://tanzu.vmware.com/security/cve-2022-22965

https://github.com/spring-projects/spring-framework/releases

 

Spring has a new 0day Remote-Code-Execution problem, related to spring-beans and JDK9+

Fixed at spring 5.3.18 / 5.2.20