Spring Framework 特定条件下目录遍历漏洞（CVE-2024-38816）

[molgee]

目前最新的seata版本使用的是spring framework 5.3.39版本，但是这个存在CVE-2024-38816漏洞，是否考虑升级解决这个引用漏洞问题？有没有时间计划安排

[xingfudeshi]

Thank you for your feedback. We will review and act on it.

[hnxydq]

any progess?

[xingfudeshi]

@hnxydq @molgee

Hi,

Thank you for following up on this issue. Here’s an update on our progress regarding CVE-2024-38816:

As officially announced by the Spring team[1], open-source support for Spring Framework 5.3.x (the version currently used in Seata) has ended. The fix for CVE-2024-38816 is only available in commercial releases (e.g., 5.3.40) or open-source supported versions like Spring Framework 6.1.13+.

Our team is actively evaluating the effort and risks involved in upgrading to a Spring Framework version with ongoing open-source support. We aim to address this dependency update in a future Seata release, and will keep the community informed of our timeline.

[1] https://spring.io/blog/2024/09/12/spring-framework-releases-fixes-for-cve-2024-38816