CCD-3359: CVE-2022-22978: ccd-message-publisher

build.gradle

@@ -11,7 +11,7 @@ plugins {
 }
 
 ext['spring-framework.version'] = '5.3.20'
-ext['spring-security.version'] = '5.4.5'
+ext['spring-security.version'] = '5.7.1'
 ext['log4j2.version'] = '2.17.1'
 ext['jackson.version'] = '2.13.2'
 
@@ -279,8 +279,9 @@ dependencies {
     exclude group: 'org.simpleframework', module: 'simple-xml' //CVE-2017-1000190
     exclude group: 'org.nanohttpd', module: 'nanohttpd' //CVE-2020-13697
   }
-  //CVE-2021-22119
-  implementation (group: 'org.springframework.security', name:'spring-security-crypto', 'version':'5.4.7')
+  //CVE-2022-22978
+  implementation (group: 'org.springframework.security', name:'spring-security-crypto', 'version':'5.7.1')
+  implementation group: 'org.springframework.security', name: 'spring-security-rsa', version: '1.0.11.RELEASE'
   // CVE-2021-43797
   implementation group: 'io.netty', name:'netty-buffer', version: versions.netty
   implementation group: 'io.netty', name:'netty-codec', version: versions.netty

charts/ccd-message-publisher/Chart.yaml

@@ -2,14 +2,14 @@ apiVersion: v2
 description: A Helm chart for the HMCTS CCD Message Publisher
 name: ccd-message-publisher
 home: https://github.com/hmcts/ccd-message-publisher
-version: 0.1.3
+version: 0.1.4
 maintainers:
   - name: HMCTS CCD Dev Team
 dependencies:
   - name: java
     version: 3.7.3
-    repository: '@hmctspublic'
+    repository: 'https://hmctspublic.azurecr.io/helm/v1/repo/'
   - name: servicebus
     version: 0.3.1
-    repository: '@hmctspublic'
+    repository: 'https://hmctspublic.azurecr.io/helm/v1/repo/'
     condition: servicebus.enabled

config/owasp/suppressions.xml

@@ -37,9 +37,18 @@
     <cve>CVE-2022-22968</cve>
     <cve>CVE-2022-22970</cve>
     <cve>CVE-2022-22976</cve>
-    <cve>CVE-2022-22978</cve>
     <cve>CVE-2022-22950</cve>
   </suppress>
   <!--End of temporary suppression section -->
 
+  <suppress>
+    <notes><![CDATA[
+   file name: spring-security-rsa-1.0.11.RELEASE.jar
+    The same CVE has been fixed for spring-security with version 5.7.1,
+    but still pending for the file stated here. We need detailed suppression to target the rsa file.
+   ]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-rsa@.*$</packageUrl>
+    <cve>CVE-2022-22978</cve>
+  </suppress>
+
 </suppressions>