Skip to content

Commit f7c47bb

Browse files
derjustderjust
committed
Issue #190 - Spring Data Commons vulnerability
Fixed security issue with spring-data-commons by update to version `Ingalls-SR14` - see CVE-2018-1273
1 parent bb3ce79 commit f7c47bb

File tree

2 files changed

+57
-8
lines changed

2 files changed

+57
-8
lines changed

‎pom.xml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
<modelVersion>4.0.0</modelVersion>
2121
<groupId>com.github.derjust</groupId>
2222
<artifactId>spring-data-dynamodb</artifactId>
23-
<version>4.5.7-SNAPSHOT</version>
23+
<version>4.5.7</version>
2424
<name>Spring Data DynamoDB</name>
2525
<inceptionYear>2018</inceptionYear>
2626

@@ -38,7 +38,7 @@
3838

3939
<properties>
4040
<spring.version>4.3.6.RELEASE</spring.version>
41-
<spring-data.version>Ingalls-RELEASE</spring-data.version>
41+
<spring-data.version>Ingalls-SR14</spring-data.version>
4242

4343
<hibernate-validator.version>5.2.4.Final</hibernate-validator.version>
4444
<aws-java-sdk.version>1.11.289</aws-java-sdk.version>
@@ -529,7 +529,7 @@
529529
<url>https://github.com/spring-data-dynamodb/spring-data-dynamodb</url>
530530
<connection>scm:git:ssh://github.com/spring-data-dynamodb/spring-data-dynamodb.git</connection>
531531
<developerConnection>scm:git:ssh://git@github.com/spring-data-dynamodb/spring-data-dynamodb.git</developerConnection>
532-
<tag>v5.0.2</tag>
532+
<tag>v4.5.7</tag>
533533
</scm>
534534

535535
<repositories>

‎src/changes/changes.xml

Lines changed: 54 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,56 @@
2323
<author email="zeeman@zeeman.de">derjust</author>
2424
</properties>
2525
<body>
26-
<release version="5.0.3" date="" description="Maintenance release">
26+
<release version="5.0.3" date="2018-08-10" description="Maintenance &amp; security release">
2727
<action dev="derjust" type="fix" date="2018-03-05">
2828
Fix Javadoc and cast warnings
2929
</action>
30+
<action dev="derjust" issue="142" type="add" date="2018-03-21">
31+
Added support for @Query-based projections
32+
</action>
33+
<action dev="derjust" issue="148" type="add" date="2018-03-22">
34+
Publish master builds to OSSRH as SNAPSHOT
35+
</action>
36+
<action dev="derjust" issue="146" type="fix" date="2018-03-24">
37+
Fix incomplete AWS DynamoDBMapper initialization
38+
</action>
39+
<action dev="derjust" issue="57" type="fix" date="2018-03-25">
40+
Fix compatibility with AWS SDK 1.11.36 (NullPointerException)
41+
</action>
42+
<action dev="derjust" issue="81" type="fix" date="2018-03-25">
43+
Fixed NullPointerException for DynamoDBIndexHashKey (GSI)
44+
</action>
45+
<action dev="derjust" issue="47" type="fix" date="2018-03-25">
46+
Confirmed that findByKeyAndOtherKey returns null/Optional.empty()
47+
</action>
48+
<action dev="derjust" type="add" date="2018-03-26">
49+
Use just Spring-Data Commons dependency inspired by
50+
https://github.com/sheradmin/spring-data-dynamodb/commit/57efbce2978481cbaf374f01d88424766a314662
51+
</action>
52+
<action dev="blx" type="add" date="2018-03-26">
53+
Add support for DynamoDBTypeConverted annotations on hash key
54+
</action>
55+
<action dev="derjust" type="fix" date="">
56+
Fixed NullPointerException for findAllByOrderByProperty queries
57+
</action>
58+
<action dev="CoderPaulK" issue="158" type="fix" date="2018-04-15">
59+
Fixed method signature
60+
</action>
61+
<action dev="boothen" issue="15" type="fix" date="2018-06-12">
62+
Spring Data Rest uses a PersistentEntityResourceAssembler that requires the DynamoDBMappingContext to be exposed as a Spring Bean.
63+
</action>
64+
<action dev="SimY4" issue="177" type="fix" date="2018-07-04">
65+
Fixed NPE when deleting nonexistent entity
66+
</action>
67+
<action dev="SimY4" issue="183" type="fix" date="2018-07-16">
68+
Match hibernate validator dependency version with Spring Boot 2 dependency.
69+
</action>
70+
<action dev="derjust" issue="181" type="fix" date="2018-07-16">
71+
`Pageable.unpaged()` find queries fail
72+
</action>
73+
<action dev="derjust" issue="190" type="fix" date="2018-08-10">
74+
Update to spring-data 2.0.9 due to fix CVE-2018-1273
75+
</action>
3076
</release>
3177
<release version="5.0.2" date="2018-03-05" description="Maintenance release">
3278
<action dev="vitolimandibhrata" issue="40" type="add" date="2017-01-07">
@@ -79,15 +125,18 @@
79125
<action dev="Alex Arana" type="add" issue="62">
80126
Support @DynamoDBTypeConverted instead of/in addition to @DynamoDBMarshalling for query methods
81127
</action>
128+
<action dev="derjust" type="add" issue="136">
129+
Transfer to spring-data-dynamodb organization
130+
</action>
82131
</release>
83132
<release version="5.0.0" date="2017-11-27" description="Spring 5 release" >
84133
<action dev="derjust" type="add">
85134
Added Spring 5 / Spring-Data Kay support
86135
</action>
87136
</release>
88-
<release version="4.5.6" date="2018-07-02" description="Bugfix release">
89-
<action dev="derjust" type="fix" issue="171">
90-
spring-data project artifact does not provide version information thus can't calculate compatibility
137+
<release version="4.5.7" date="2018-08-10" description="security release">
138+
<action dev="derjust" issue="190" type="fix" date="2018-08-10">
139+
Update to spring-data Ingalls-SR14 due to fix CVE-2018-1273
91140
</action>
92141
</release>
93142
<release version="4.5.5" date="2018-03-07" description="Backport of v5.0 (master)">
@@ -119,4 +168,4 @@
119168
</action>
120169
</release>
121170
</body>
122-
</document>
171+
</document>

0 commit comments

Comments
 (0)