CGA-rwg8-jxvr-5wxf

This vulnerability relates to 'spring-security', specifically the 'spring-security-core' dependency. Remediating requires upgrading to 6.3.5 or later. Attempts at upgrading this dependency (under bom/pom.xml upstream), have not been successful, resulting in build failures. Whilst Jenkins v2.479 is the supported LTS release at the time of writing, it is unlikely upstream will address in this release. See:

• https://github.com/jenkinsci/jenkins/pull/10148#pullrequestreview-2550103998