0

I recently upgraded by spring boot to 2.6.6 following a RCE vulnerability. However, application fails to start giving the following error:

***************************
APPLICATION FAILED TO START
***************************

Description:

An attempt was made to call a method that does not exist. The attempt was made from the following location:
org.springframework.boot.SpringApplication.run(SpringApplication.java:301)

The following method did not exist:
'void org.springframework.context.ConfigurableApplicationContext.setApplicationStartup(org.springframework.core.metrics.ApplicationStartup)'

The calling method's class, org.springframework.boot.SpringApplication, was loaded from the following location:

jar:file:/Users/mahulivishal/.m2/repository/org/springframework/boot/spring-boot/2.6.6/spring-boot-2.6.6.jar!/org/springframework/boot/SpringApplication.class

The called method's class, org.springframework.context.ConfigurableApplicationContext, is available from the following locations:

jar:file:/Users/mahulivishal/.m2/repository/org/springframework/spring-context/5.2.5.RELEASE/spring-context-5.2.5.RELEASE.jar!/org/springframework/context/ConfigurableApplicationContext.class

The called method's class hierarchy was loaded from the following locations:

org.springframework.context.ConfigurableApplicationContext: file:/Users/mahulivishal/.m2/repository/org/springframework/spring-context/5.2.5.RELEASE/spring-context-5.2.5.RELEASE.jar

Action:

Correct the classpath of your application so that it contains compatible versions of the classes org.springframework.boot.SpringApplication and org.springframework.context.ConfigurableApplicationContext

Process finished with exit code 1

Here are dependencies from my pom.xml:

        <parent>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-parent</artifactId>
            <version>2.6.6</version>
        </parent>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <version>2.6.6</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <version>5.2.5.RELEASE</version>
        </dependency>
Strikers
  • 4,698
  • 2
  • 28
  • 58
Vishal Mahuli
  • 337
  • 3
  • 6
  • 13
  • Why are you explicitly specifying the version of `spring-context`? You should let the Spring Boot BOM in Maven dependency-management handle that. It seems like 5.2.5 is the wrong version. According to https://docs.spring.io/spring-boot/docs/2.6.6/reference/html/dependency-versions.html#appendix.dependency-versions, Spring Boot 2.6.6 expects spring-context 5.3.18. – Mark Rotteveel May 02 '22 at 11:06
  • @MarkRotteveel If I don't add it, this is the error I am getting - java: cannot access org.springframework.context.ConfigurableApplicationContext class file for org.springframework.context.ConfigurableApplicationContext not found – Vishal Mahuli May 02 '22 at 12:11
  • That probably means you don't import the Spring Boot BOM in the `dependencyManagement` section of your POM. You shouldn't specify the version of any of the dependencies shown in your question, but instead let the BOM define those versions. – Mark Rotteveel May 02 '22 at 17:08

1 Answers1

0

I found the solution to this. There were 2 problems in total here:

  1. spring-boot 2.6.6 wasn't compatible with spring-context 5.2.5.RELEASE
  2. Spring has moved support for netflix-zuul to maintenance mode, so Zuul wouldn't work with 2.6.6

Solution: Downgrade spring-boot to 2.4.12 (2.4.x) for Zuul support, and upgrade the spring version to 5.3.18 so to prevent exposure to the RCE vulnerability. Also, use a spring-cloud-starter-bootstrap 3.0.1 for sping-context incompatibility. remove the spring-context dependency.

    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.4.12</version>
    <properties>
       <java.version>11</java.version>
       <log4j2.version>2.16.0</log4j2.version>
       <spring.version>5.3.18</spring.version>
    </properties>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
        <version>2.4.12</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-bootstrap</artifactId>
        <version>3.0.1</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-netflix-zuul</artifactId>
        <version>2.2.2.RELEASE</version>
    </dependency>
Vishal Mahuli
  • 337
  • 3
  • 6
  • 13