[FP]: Possibly FP on Spring Core 5.2.x branch

[Nriver]

Package URl

https://mvnrepository.com/artifact/org.springframework/spring-core/5.2.22.RELEASE

CPE

cpe:2.3:a:pivotal_software:spring_framework:5.2.22:release::::::

CVE

CVE-2016-1000027

ODC Integration

No response

ODC Version

7.1.0

Description

No response

[github-actions]

Error parsing package url: https://mvnrepository.com/artifact/org.springframework/spring-core/5.2.22.RELEASE.

Error: Error: purl is missing the required "pkg" scheme component.

Please correct the package URL - consider copying the package url from the HTML report.

[aikebah]

Whilst typically not micromanaging vulnerabilities of the Spring Framework components to hit only for that component (as NVD datasource bundles them all in the spring_framework CPE), I think this one would be a proper exception, as the vulnerable code is deliberately kept in by the Spring Framework team (deprecated for removal) until the release of version 6 of the framework (removal is in 6.0.0-M1, so it would hit on each and every 5.x release.

[wenjunattech]

Hi, can i check why does the suppression exclude spring-web? Wouldn't the dependencyCheck failed?

[aikebah]

It excludes spring-web because the CVE is applicable to it. Currently the developer needs to verify whether or not they use the vulnerable code which is still in the library. Only Spring 6 (still to be released) will contain a fix by removing all the remoting classes from the library.

spring-projects/spring-framework#25379 deprecated the vulnerable classes and 6.0.0-M1 milestone removed the vulnerable classes as part of spring-projects/spring-framework#27422

[wenjunattech]

Hi @aikebah , thank you for your prompt reply. Can I further verify a few points:

• Is searching for HttpInvokerServiceExporter within the code base be suffice in verifying the usage?
• If no usage found, how can I modify the suppressing to include spring-web as well?

[aikebah]

Not well enough familiar with the Springframework to know in which ways you can enable these remoting features. So cannot advice you on that part. Beyond direct usage in your code there may or may not be other ways to enable the feature that do not include the classname.

Regarding suppressing it for spring-web I would advice to just use the dedicated suppression for the spring-web packageUrl, which you can obtain from the HTML report by clicking the suppress button next to the CVE link for CVE-2016-1000027. That will suffice to suppress it.

[aikebah]

A quick look on https://docs.spring.io/spring-framework/docs/5.3.x/reference/html/integration.html#remoting-httpinvoker seems to suggest that searching for HttpInvokerServiceExporter within the codebase (including configuration files) should suffice to determine that the RPC remoting via HTTP Invoker is not configured for your project.

[wenjunattech]

Regarding the HTML report, how can I obtain it?

[THausherr]

Same for 5.3.20:

spring-core-5.3.20.jar (pkg:maven/org.springframework/spring-core@5.3.20, cpe:2.3:a:pivotal_software:spring_framework:5.3.20:*:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:5.3.20:*:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:5.3.20:*:*:*:*:*:*:*, cpe:2.3:a:vmware:springsource_spring_framework:5.3.20:*:*:*:*:*:*:*) : CVE-2016-1000027
spring-tx-5.3.20.jar (pkg:maven/org.springframework/spring-tx@5.3.20, cpe:2.3:a:pivotal_software:spring_framework:5.3.20:*:*:*:*:*:*:*, cpe:2.3:a:springsource:spring_framework:5.3.20:*:*:*:*:*:*:*, cpe:2.3:a:vmware:spring_framework:5.3.20:*:*:*:*:*:*:*) : CVE-2016-1000027

[THausherr]

Regarding the HTML report, how can I obtain it?

your-project-directory\target\dependency-check-report.html