jmeter ships with a vulnerable version of spring
Open
need info
os: All
P2
- Dominant language
- Java
- Stars
- 9.5k
- Forks
- 2.3k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 5
Description
**Ren** ([Bug 66011](https://bz.apache.org/bugzilla//show_bug.cgi?id=66011&redirect=false)):
jmeter references a vulnerable version of the sprint framework. My customer blocks access to all vulnerable versions of spring thus making it imposible for me to run jmeter from within the jmeter-maven-plugin (which downloads all jmeter dependencies automagically).
When will there be a release using a safe version of spring framework (>= 5.3.18)
Regards
René
Severity: major
OS: All
Contributor guide
Assessment
This issue has not been assessed yet.