Skip to content

Upgrade spring-core from 5.3.26 to 5.3.27.#2717

Merged
RyanL1997 merged 3 commits into
opensearch-project:mainfrom
Rishikesh1159:fix-CVE-2023-20863
May 5, 2023
Merged

Upgrade spring-core from 5.3.26 to 5.3.27.#2717
RyanL1997 merged 3 commits into
opensearch-project:mainfrom
Rishikesh1159:fix-CVE-2023-20863

Conversation

@Rishikesh1159
Copy link
Copy Markdown
Member

Description

[Describe what this change achieves]
Upgrade spring-core from 5.3.26 to 5.3.27 to fix CVE-2023-20863

Issues Resolved

CVE-2023-20863

Is this a backport? If so, please add backport PR # and/or commits #

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

  • New functionality includes testing
  • New functionality has been documented
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Rishikesh1159 <rishireddy1159@gmail.com>
Copy link
Copy Markdown
Contributor

@stephen-crawford stephen-crawford left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@cwperks
Copy link
Copy Markdown
Member

cwperks commented Apr 25, 2023

@Rishikesh1159 Can you re-base or merge the latest commits from main into this branch? There was a build fixing PR merged recently.

@Rishikesh1159
Copy link
Copy Markdown
Member Author

@Rishikesh1159 Can you re-base or merge the latest commits from main into this branch? There was a build fixing PR merged recently.

Sure

@RyanL1997
Copy link
Copy Markdown
Collaborator

The CI failure is cased by opensearch-project/OpenSearch#7286. We are awaiting until the new snapshot is released with the corrected version.

@RyanL1997 RyanL1997 added backport 2.x backport 1.3 backport to 1.3 branch backport 1.x backport to 1.x branch labels May 5, 2023
@RyanL1997 RyanL1997 merged commit 54d47ab into opensearch-project:main May 5, 2023
@opensearch-trigger-bot
Copy link
Copy Markdown
Contributor

The backport to 1.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-1.x 1.x
# Navigate to the new working tree
cd .worktrees/backport-1.x
# Create a new branch
git switch --create backport/backport-2717-to-1.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 54d47ab181c4c782af37c96521238f7dbaf50cb2
# Push it to GitHub
git push --set-upstream origin backport/backport-2717-to-1.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-1.x

Then, create a pull request where the base branch is 1.x and the compare/head branch is backport/backport-2717-to-1.x.

@opensearch-trigger-bot
Copy link
Copy Markdown
Contributor

The backport to 1.3 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-1.3 1.3
# Navigate to the new working tree
cd .worktrees/backport-1.3
# Create a new branch
git switch --create backport/backport-2717-to-1.3
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 54d47ab181c4c782af37c96521238f7dbaf50cb2
# Push it to GitHub
git push --set-upstream origin backport/backport-2717-to-1.3
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-1.3

Then, create a pull request where the base branch is 1.3 and the compare/head branch is backport/backport-2717-to-1.3.

opensearch-trigger-bot Bot pushed a commit that referenced this pull request May 5, 2023
Signed-off-by: Rishikesh1159 <rishireddy1159@gmail.com>
(cherry picked from commit 54d47ab)
cwperks added a commit that referenced this pull request May 15, 2023
Signed-off-by: Rishikesh1159 <rishireddy1159@gmail.com>
(cherry picked from commit 54d47ab)

Co-authored-by: Rishikesh Pasham <62345295+Rishikesh1159@users.noreply.github.com>
stephen-crawford pushed a commit to stephen-crawford/security that referenced this pull request May 16, 2023
…pensearch-project#2763)

Signed-off-by: Rishikesh1159 <rishireddy1159@gmail.com>
(cherry picked from commit 54d47ab)

Co-authored-by: Rishikesh Pasham <62345295+Rishikesh1159@users.noreply.github.com>
sebastianmichalski pushed a commit to sebastianmichalski/security that referenced this pull request May 19, 2023
Signed-off-by: Rishikesh1159 <rishireddy1159@gmail.com>
MaciejMierzwa pushed a commit to MaciejMierzwa/security that referenced this pull request Jun 13, 2023
Signed-off-by: Rishikesh1159 <rishireddy1159@gmail.com>
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
MaciejMierzwa pushed a commit to MaciejMierzwa/security that referenced this pull request Jun 13, 2023
Signed-off-by: Rishikesh1159 <rishireddy1159@gmail.com>
Signed-off-by: Maciej Mierzwa <dev.maciej.mierzwa@gmail.com>
davidlago pushed a commit that referenced this pull request Jun 18, 2023
This mirrors the changes in main (#2717) and 2.x (#2763). The backport workflow was not used because there have been major changes to the build file between 1.x and 2.x

Signed-off-by: Kartik Ganesh <gkart@amazon.com>
davidlago pushed a commit to davidlago/security that referenced this pull request Jun 18, 2023
This mirrors the changes in main (opensearch-project#2717) and 2.x (opensearch-project#2763). The backport workflow was not used because there have been major changes to the build file between 1.x and 2.x

Signed-off-by: Kartik Ganesh <gkart@amazon.com>

Bump spring-core to 5.3.28

Co-authored-by: Andriy Redko <drreta@gmail.com>
Signed-off-by: Kartik Ganesh <gkart@amazon.com>

Also bumping spring-expression to 5.3.28

Co-authored-by: Andriy Redko <drreta@gmail.com>
Signed-off-by: Kartik Ganesh <gkart@amazon.com>
davidlago pushed a commit to davidlago/security that referenced this pull request Jun 18, 2023
This mirrors the changes in main (opensearch-project#2717) and 2.x (opensearch-project#2763). The backport workflow was not used because there have been major changes to the build file between 1.x and 2.x

Signed-off-by: Kartik Ganesh <gkart@amazon.com>

Bump spring-core to 5.3.28

Co-authored-by: Andriy Redko <drreta@gmail.com>
Signed-off-by: Kartik Ganesh <gkart@amazon.com>

Also bumping spring-expression to 5.3.28

Co-authored-by: Andriy Redko <drreta@gmail.com>
Signed-off-by: Kartik Ganesh <gkart@amazon.com>
Signed-off-by: Dave Lago <davelago@amazon.com>
davidlago pushed a commit that referenced this pull request Jun 18, 2023
#2873)

This mirrors the changes in main (#2717) and 2.x (#2763). The backport workflow was not used because there have been major changes to the build file between 1.x and 2.x



Bump spring-core to 5.3.28




Also bumping spring-expression to 5.3.28

Signed-off-by: Kartik Ganesh <gkart@amazon.com>
Signed-off-by: Dave Lago <davelago@amazon.com>
Co-authored-by: Kartik Ganesh <gkart@amazon.com>
Co-authored-by: Andriy Redko <drreta@gmail.com>
samuelcostae pushed a commit to samuelcostae/security that referenced this pull request Jun 19, 2023
Signed-off-by: Rishikesh1159 <rishireddy1159@gmail.com>
samuelcostae pushed a commit to samuelcostae/security that referenced this pull request Jun 19, 2023
Signed-off-by: Rishikesh1159 <rishireddy1159@gmail.com>
Signed-off-by: Sam <samuel.costa@eliatra.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport 1.x backport to 1.x branch backport 1.3 backport to 1.3 branch

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants