How to fetch the CVE report of a commercial release of spring boot

Products

• VMware Tanzu Spring Runtime

Issue/Introduction

Tanzu Spring Runtime product is a commercial subscription that includes multiple benefits on top of the value that the Spring open source projects and ecosystem provide. For Spring Boot minor versions that have entered Commercial support and are no longer under OSS support, commercial patch releases are made available through a Spring Enterprise Subscription, our Spring artifact repository. This article provides steps to fetch the CVE report of a commercial release.

Resolution

1. Identify the target version

Let's take an example of the version 2.7.19.

2. Compose a URL with the base, https://enterprise.spring.io/projects/spring-boot/ and the version, 2.7.19

https://enterprise.spring.io/projects/spring-boot/[VERSION]

The URL combined for the example is: https://enterprise.spring.io/projects/spring-boot/2.7.19 

3. Open this URL in browser and look for “Spring Framework” in the left hand side. The changelog will have CVE fixes for the version.