NYanamala419936 (Community Member) asked a question.
We have developed application with spring boot (2.5.12) and java (11).After scan the my application, it's showing venerability issue like need to upgrade the spring web 5.3 to spring web 6.0 version. If i change the versions, getting compile time issues
We have developed application with spring boot (2.5.12) and java (11).After scan the my application, it's showing venerability issue like need to upgrade the spring web 5.3 to spring web 6.0 version. If i change the versions, getting compile time issues and runtime issues.
Could you tell us the procedure, what are the steps need to perform to resolve the issue.
.png){kind=logo}
Hello @NYanamala419936 (Community Member)
If I understood, you saw the results from SCA reports right? I suggest you run a SCA agent-based scan with --update-advisor enabled. With this flag you can see on the end of your terminal if the newer libs will break the compatibility.
Links:
SCA Agent-Based Scan Quickstart | Veracode Docs
Configure the Update Advisor for Veracode SCA | Veracode Docs
You can use the database of Veracode to search and see all information about the versions of libs like spring web. You can search the safe version in this link (logged with your Veracode account) Vulnerabilities found in the Java - Spring Web library - Veracode
the last version vunerable (now) is the 5.3.26 and the first safe version (now) is 5.3.27. So, you can update, compile and test to see.