https://grails.org/ logo
Join Slack
Powered by
I’m working through updating some security finding...
# questions
d
I’m working through updating some security findings and seeing a lot of CVEs for org.grails:grails-datastore-rest-client any plans to have this plugin updated?
j
Which CVEs are currently outstanding?
d
https://www.cve.org/CVERecord?id=CVE-2022-22965 Introduced through org.grails:grails-datastore-rest-client@6.1.5.RELEASE Fixed in org.springframework:spring-beans@5.2.20, @5.3.18 https://www.cve.org/CVERecord?id=CVE-2020-5421 Introduced through org.grails:grails-datastore-rest-client@6.1.5.RELEASE Fixed in org.springframework:spring-web@4.3.29.RELEASE, @5.0.19.RELEASE, @5.1.18.RELEASE, @5.2.9.RELEASE https://www.cve.org/CVERecord?id=CVE-2024-22243 Introduced through org.grails:grails-datastore-rest-client@6.1.5.RELEASE Fixed in org.springframework:spring-web@5.3.32, @6.0.17, @6.1.4 https://www.cve.org/CVERecord?id=CVE-2020-17521 Introduced through org.grails:grails-datastore-rest-client@6.1.5.RELEASE Fixed in org.grails:grails-encoder@3.3.17, @4.1.3, @5.3.4, @6.1.0
j
Thank you. Will look those over. Those are very old releases.
🙌 1
d
theres a bunch more but i wont bother posting every single one atm those are the top ones
let me know if you want all of the ones i have an i can put them in a excel or something useful
j
I don't. Thank you!
d
thank you!!
j
I think the answer to your initial question is "probably not", but will investigate.
d
if there wont be an update, any suggestions, am i able to update myself? or is there a newer alternative?
j
There are newer releases than listed above. I don't know if they will have new enough dependencies to address the issues though.
"am i able to update myself" - Quite possibly.
d
they do not - im using the latest offered 6.1.12.RELEASE
j
I think 6.1.5 was released around 2017. Those are going to be fairly old dependencies.
Right. 6.1.12 was 2019.
I am not 100% sure but I think the rest client module was removed for grails-data-mapping 7.0.
d
yea i see that ok thanks
👍 1
i belive my answer to alot of these upgrades is going to be we cant stop at grails5 must keep going!
j
You should.
d
yea its the plan - we are coming from grails3 so my hope was to get all our apps and plugins on grails5
and then go from there
j
"am i able to update myself" - If that is something you are interested in helping with, the code at https://github.com/grails/grails-data-mapping/tree/6.1.x/grails-datastore-rest-client is a good starting point. If you are interested in that, I think it would be good to have an initial discussion with the dev team to shortcut some things and make sure everyone is on the same page.
👍 1
There actually isn't a whole ton of code there. It has been years since I looked at it and just now browsing there for a minute I am reminded of that.
j
looking over the CVE list, most of these seem spring related. We jumped to the latest version of spring in Grails 7; so those CVEs should be fixed when it’s released. I think Grails 6.x can run spring 5.3.x. If you need spring 6, grails 7 will be the only way that will work due to the javax transition
👍 1
2 Views
Open in Slack
PreviousNext
Powered by