This message was deleted.

@Allison Martin I have bumped Spring Security Core without problems. You'll have to test if it works in you app (it probably will). You can bump it by setting

spring-security.version=5.7.5

in

gradle.properties

.

Thanks! The 5.7.4 to 5.7.5 version I was referring to was the actual Spring Security Core jar, which is found in the file system. While examining the build.gradle, I see Grails 5.2 is using Spring Security 5.6.4. The advisory states that the issue is fixed in 5.6.9. Would it be advisable to update the Spring version on our current release of Grails?

If you run:

./gradlew dependencyInsight --dependency org.springframework.security:spring-security-core --configuration runtimeClasspath

you will see which version is actually selected. I would probably go directly with the latest v5 (

5.8.8

).

Thanks! I will have one of my engineers give this a try.