Update spring-security-oauth2 to 2.3.7.RELEASE

[OrangeDog]

The last release (2.1.6) missed the fix for CVE-2019-11269.

[jzheaux]

@OrangeDog thanks for the report. This project needs to have this ticket fixed in order to upgrade to a newer spring-security-oauth2 dependency.

If you are not using the check token endpoint, then you should be fine to follow the steps indicated in that CVE to override the spring-security-oauth2 dependency.

[jzheaux]

I've updated the ticket description to indicate the next viable version that this project could be updated to.

[OrangeDog]

the steps indicated in that CVE

They assume Boot 1.x, not Boot 2.x.
That just means you need to add it to <dependencyManagement> though.

[OrangeDog]

Hold the press if possible! Darn, too slow.
Turns out 2.3.7.RELEASE broke a lot of de-serialisation due to attempting to add a closed whitelist.
That's been reverted for 2.7.8.RELEASE, but not released yet.