Upgrading Spring Framework to fix RCE vulnerability on Camunda 7.13

Camunda 7 Topics Discussion & Questions
1

Hello,

I’m trying to upgrade Spring Framework to patched versions (5.3.18 or 5.2.20.RELEASE) from current version 4.3.23.RELEASE.

I’m using Camunda 7.13.0 and Java 8.

I am having various dependency issues when updating to 5.3.18 or 5.2.20 on pom.xml

Are there compatible sets of configuration properties that work with Camunda 7.13.0 when switching to the patched Spring Framework versions?

The spring configuration is manually set and is flexible to adding dependencies Spring 5.3.18 or 5.2.20.RELEASE could need.

Thank you

2

@voxparcxls You can check the compatible versions from this matrix.

image
image1390×1606 171 KB

3

Hi @aravindhrs thanks for the response.

However, i was looking more so info about Camunda and Spring Framework dependencies

Something like this:

– shows the maven dependencies with camunda and spring framework.

Screen Shot 2022-04-13 at 10.42.25 PM
Screen Shot 2022-04-13 at 10.42.25 PM1398×1736 377 KB

This shows Camunda 7.17 with Spring 5.3.18

I wanted to verify if Camunda 7.13 also works with Spring 5.3.18

4