MANIFEST.MF only has the following line, so that SpringSecurityCoreVersion.getVersion() just returns null:
However, MANIFEST.MF of spring-security-core-4.2.2.RELEASE.jar had the following lines, especially Implementation-Version:
Manifest-Version: 1.0
Implementation-Title: spring-security-core
Premain-Class: true
Implementation-Version: 4.2.2.RELEASE
Can-Redefine-Classes: true
Agent-Class: true
Can-Retransform-Classes: true
Can-Set-Native-Method-Prefix: false
Created-By: Spring Security Team