snicoll-scratches/spring-boot-cve-2022-22965Showcase of overridding the Spring Framework version in older Spring Boot versions
= Spring Framework version override showcase
This repository showcases how you can override the Spring Framework version of a Spring Boot 2.4-based application.
Spring Boot 2.4.x is https://spring.io/projects/spring-boot#support[out of OSS support], the latest version is 2.4.13. It uses Spring Framework 5.3.13 that is vulnerable to https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement[CVE-2022-22965].
Three sample projects are provided:
spring-boot-2.4-gradle: A gradle-based project showcasing how you can use ext to override the Spring Framework version.spring-boot-2.4-maven: A maven-based project showcasing how you can use the spring-framework.version property when using the Spring Boot parent.spring-boot-2.4-maven-custom-parent: A maven-based project showcasing how you can import the Spring Framework BOM when using a custom parent.