Upgrading Spring Boot version in pom.xml file did not resolve dependencies.

mbadwa
mbadwa Posts: 7
in LFS262 Class Forum

Please find attached is .txt file for the dependencies that needs updating. How do I go about it?

Comments

  • manuel.nhiuana
    manuel.nhiuana Posts: 12

    @mbadwa said:
    Please find attached is .txt file for the dependencies that needs updating. How do I go about it?

    same problem here, did you manage to fix? I tried version 3.0.2 but is giving error on build stage, and 2.7.8 the build is failing with dependency error. to get the lab going I just set failBuildOnCVSS to 11

    [INFO] ------------------------------------------------------------------------

    [INFO] BUILD FAILURE

    [INFO] ------------------------------------------------------------------------

    [INFO] Total time: 01:01 min

    [INFO] Finished at: 2023-01-26T09:07:03Z

    [INFO] ------------------------------------------------------------------------

    [ERROR] Failed to execute goal org.owasp:dependency-check-maven:6.1.1:check (default-cli) on project demo:

    [ERROR]

    [ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '8.0':

    [ERROR]

    [ERROR] snakeyaml-1.30.jar: CVE-2022-1471

    [ERROR] spring-boot-2.7.8.jar: CVE-2016-1000027, CVE-2022-22965

    [ERROR] spring-boot-starter-data-rest-2.7.8.jar: CVE-2016-1000027, CVE-2022-22965

    [ERROR] spring-core-5.3.25.jar: CVE-2016-1000027

    [ERROR] spring-data-commons-2.7.7.jar: CVE-2016-1000027, CVE-2022-22965

    [ERROR] spring-data-rest-core-3.7.7.jar: CVE-2022-22965, CVE-2016-1000027

    [ERROR] spring-hateoas-1.5.2.jar: CVE-2016-1000027, CVE-2022-22965

    [ERROR] spring-plugin-core-2.0.0.RELEASE.jar: CVE-2016-1000027, CVE-2022-22965

    [ERROR] spring-web-5.3.25.jar: CVE-2016-1000027

    [ERROR]

    [ERROR] See the dependency-check report for more details.

    [ERROR]

    [ERROR]

    [ERROR] -> [Help 1]

    [ERROR]

    [ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.

    [ERROR] Re-run Maven using the -X switch to enable full debug logging.

    [ERROR]

    [ERROR] For more information about the errors and possible solutions, please read the following articles:

    [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException

    script returned exit code 1

  • manuel.nhiuana
    manuel.nhiuana Posts: 12

    still fails on SAST

  • elsanchez
    elsanchez Posts: 2

    Same problem here. Snakeyaml continues to have High severity issues.

  • gbalamurugan
    gbalamurugan Posts: 6
    edited February 2023

    Hi all,

    I got the same issue. adding the below dependency into pom.xml resolved the issue.

    <!-- https://mvnrepository.com/artifact/org.yaml/snakeyaml -->
<dependency>
    <groupId>org.yaml</groupId>
    <artifactId>snakeyaml</artifactId>
    <version>1.32</version>
</dependency>

    Regards,
    Bala

Categories

Upcoming Training