From 080075d44e7636d2ec2921b0b5bab97f41a04e9c Mon Sep 17 00:00:00 2001
From: Stanislav Trailov <stanislav.trailov@bosch.io>
Date: Tue, 22 Aug 2023 17:09:21 +0300
Subject: [PATCH] Override spring-security-oauth2-client and h2 dependency
 versions to fix latest cve findings (#1419)

Signed-off-by: Stanislav Trailov <Stanislav.Trailov@bosch.io>
---
 pom.xml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pom.xml b/pom.xml
index bc0a5874d..9d3c24a22 100644
--- a/pom.xml
+++ b/pom.xml
@@ -135,6 +135,8 @@
       <spring.boot.version>2.7.14</spring.boot.version>
       <spring.cloud.version>2021.0.5</spring.cloud.version>
       <spring.plugin.core.version>2.0.0.RELEASE</spring.plugin.core.version>
+      <!-- CVE-2022-31690 Remove after Spring 3.0.0 migration-->
+      <spring.security.oauth2.client.version>5.7.10</spring.security.oauth2.client.version>
 
       <!-- Spring boot version overrides (should be reviewed with every boot upgrade) - START -->
       <!-- Newer versions needed than defined in Boot -->
@@ -143,6 +145,9 @@
       <snakeyaml.version>1.33</snakeyaml.version>
       <!-- Spring boot version overrides - END -->
 
+      <!-- CVE-2022-45868 -->
+      <h2.version>2.2.220</h2.version>
+
       <rabbitmq.http-client.version>5.0.0</rabbitmq.http-client.version>
 
       <!-- Eclipselink - START -->
@@ -835,6 +840,12 @@
             <artifactId>spring-plugin-core</artifactId>
             <version>${spring.plugin.core.version}</version>
          </dependency>
+         <!-- CVE-2022-31690 Remove after Spring 3.0.0 migration-->
+         <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-oauth2-client</artifactId>
+            <version>${spring.security.oauth2.client.version}</version>
+         </dependency>
 
          <!-- Protostuff Io -->
          <dependency>