[RANGER-3788] Upgrade spring to 5.3.20

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.0
• Fix Version/s: 3.0.0
• Component/s: admin
• Flags: Important
• External issue URL: https://github.com/apache/ranger/pull/152
• Assignee: Unassigned
• Reporter: Christian Pfarr
• Created: 14/Jun/22 08:05
• Updated: 31/Mar/23 11:59
• Resolved: 21/Jun/22 08:46

Description

https://nvd.nist.gov/vuln/detail/CVE-2022-22970

https://nvd.nist.gov/vuln/detail/CVE-2022-22971 

https://github.com/spring-projects/spring-framework/releases/tag/v5.3.20 

Spring seems to be vulnerable to DoS attacks when handling file uploads.

We´ve got some Security Reports and need a fix in future releases.

Upgrading to 5.3.20 should be enough.

Issue Links

• is cloned by: RANGER-4163 Upgrade spring framework to 5.3.26 and jettison to 1.5.4