Fix spring jar medium security vulnerabilities

[ShahimSharafudeen]

Description

Fixing OSS CVEs for medium transitive vulnerabilities in the benchto-driver jar originating from Spring JARs

Motivation and Context

CVEs
CVE-2022-22950
WS-2016-7112
CVE-2022-22968
CVE-2024-38808
CVE-2023-20861
CVE-2023-20863
CVE-2024-38820

Impact

Test Plan

Contributor checklist

• Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==
Security Changes
* Fix `CVE-2022-22950 <https://www.mend.io/vulnerability-database/CVE-2022-22950>`_. :pr:`24307`
* Fix `WS-2016-7112 <https://www.mend.io/vulnerability-database/WS-2016-7112>`_. :pr:`24307`
* Fix `CVE-2022-22968 <https://www.mend.io/vulnerability-database/CVE-2022-22968>`_. :pr:`24307`
* Fix `CVE-2024-38808 <https://www.mend.io/vulnerability-database/CVE-2024-38808>`_. :pr:`24307`
* Fix `CVE-2023-20861 <https://www.mend.io/vulnerability-database/CVE-2023-20861>`_. :pr:`24307`
* Fix `CVE-2023-20863 <https://www.mend.io/vulnerability-database/CVE-2023-20863>`_. :pr:`24307`
* Fix `CVE-2024-38820 <https://www.mend.io/vulnerability-database/CVE-2024-38820>`_. :pr:`24307`

[imjalpreet]

In my opinion, we should avoid excluding dependencies. Instead, we can enforce using a CVE-free version of this dependency through Dependency Management.

It is possible this dependency might be required when running benchto which is not detected in our CI pipeline.

[ZacBlanco]

+1

[steveburnett]

Thanks for the release note! Could you add a short phrase explaining what work you did here to address these CVEs? Maybe something like (I borrowed your commit message for this example, please rephrase as you think correct):

* Fix spring jar medium security vulnerabilities in response to (CVE_1 link). :pr:`24307`
* Fix spring jar medium security vulnerabilities in response to (CVE_2 link). :pr:`24307`