rewe-digital / integration-patterns Goto Github PK

Hi,

it may be a good idea to use current versions of spring-boot. I did not verify if we have security issues here. If there are no reasons to stay at these specific versions I would like to just bump them.

One or more dependencies were identified with known vulnerabilities in header-footer:

spring-boot-1.5.7.RELEASE.jar (org.springframework.boot:spring-boot:1.5.7.RELEASE, cpe:/a:pivotal_software:spring_boot:1.5.7) : CVE-2018-1196, CVE-2017-8046
tomcat-embed-core-8.5.20.jar (cpe:/a:apache_software_foundation:tomcat:8.5.20, cpe:/a:apache:tomcat:8.5.20, cpe:/a:apache_tomcat:apache_tomcat:8.5.20, org.apache.tomcat.embed:tomcat-embed-core:8.5.20) : CVE-2017-12617
jackson-databind-2.8.10.jar (cpe:/a:fasterxml:jackson-databind:2.8.10, cpe:/a:fasterxml:jackson:2.8.10, com.fasterxml.jackson.core:jackson-databind:2.8.10) : CVE-2017-17485, CVE-2018-7489, CVE-2018-5968
spring-aop-4.3.11.RELEASE.jar (cpe:/a:pivotal_software:spring_framework:4.3.11, cpe:/a:pivotal:spring_framework:4.3.11, org.springframework:spring-aop:4.3.11.RELEASE) : CVE-2018-1199

One or more dependencies were identified with known vulnerabilities in product-information:

spring-kafka-2.1.4.RELEASE.jar (cpe:/a:pivotal:spring_framework:2.1.4, cpe:/a:pivotal_software:spring_framework:2.1.4, org.springframework.kafka:spring-kafka:2.1.4.RELEASE) : CVE-2016-9878
jackson-databind-2.9.4.jar (com.fasterxml.jackson.core:jackson-databind:2.9.4, cpe:/a:fasterxml:jackson:2.9.4, cpe:/a:fasterxml:jackson-databind:2.9.4) : CVE-2018-7489
spring-boot-2.0.0.RELEASE.jar (cpe:/a:pivotal_software:spring_boot:2.0.0.m4, org.springframework.boot:spring-boot:2.0.0.RELEASE) : CVE-2018-1196, CVE-2017-8046
zookeeper-3.4.10.jar (org.apache.zookeeper:zookeeper:3.4.10, cpe:/a:apache:zookeeper:3.4.10) : CVE-2014-0085
scala-library-2.11.11.jar (org.scala-lang:scala-library:2.11.11, cpe:/a:scala-lang:scala:2.11.11) : CVE-2017-15288

One or more dependencies were identified with known vulnerabilities in product-detail-page:

spring-boot-2.0.0.RELEASE.jar (cpe:/a:pivotal_software:spring_boot:2.0.0.m4, org.springframework.boot:spring-boot:2.0.0.RELEASE) : CVE-2018-1196, CVE-2017-8046
spring-kafka-2.1.4.RELEASE.jar (cpe:/a:pivotal:spring_framework:2.1.4, cpe:/a:pivotal_software:spring_framework:2.1.4, org.springframework.kafka:spring-kafka:2.1.4.RELEASE) : CVE-2016-9878
jackson-databind-2.9.4.jar (com.fasterxml.jackson.core:jackson-databind:2.9.4, cpe:/a:fasterxml:jackson:2.9.4, cpe:/a:fasterxml:jackson-databind:2.9.4) : CVE-2018-7489
zookeeper-3.4.10.jar (org.apache.zookeeper:zookeeper:3.4.10, cpe:/a:apache:zookeeper:3.4.10) : CVE-2014-0085
scala-library-2.11.11.jar (org.scala-lang:scala-library:2.11.11, cpe:/a:scala-lang:scala:2.11.11) : CVE-2017-15288

Tests using testcontainers run quite slow, so these should be run as a separate test suite

The test ProductRestControllerTest. testProductInsert () is flaky.