Spring vulnerability remediation status

Products

• CA API Gateway

Issue/Introduction

We are having 11.0 docker based container and we found that its having spring vulnerability named as spring-webmvc-5.3.5.jar,ihow we can remediate the same?

the path where vulnerability is /opt/Securespan/Gateway/runtime/lib. Below are the CVE's.

CVE-2022-22965

CVE-2024-38819

Are we remediating it in next version so can we upgrade the same?

Environment

11.0

Resolution

CA API  Gateway not affected by both CVE's.  
For CVE-2022-22965, we do not use the functionality that is affected by the CVE.  Same for CVE-2024-38819 - it requires 2 conditions and we don't meet one of those conditions as we do not use the Router Functions to serve static resources.