Skip to content
This repository has been archived by the owner on Nov 9, 2017. It is now read-only.

Upgrade Apache Commons Collections to v3.2.2 #4

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Upgrade Apache Commons Collections to v3.2.2 #4

wants to merge 2 commits into from

Conversation

gmlewis
Copy link

@gmlewis gmlewis commented Mar 10, 2016

Version 3.2.1 has a CVSS 10.0 vulnerability. That is the worst kind of
vulnerability that exists. By merely existing on the classpath, this
library causes the Java serialization parser for the entire JVM process
to go from being a state machine to a turing machine. A turing machine
with an exec() function!

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8103
https://commons.apache.org/proper/commons-collections/security-reports.html
http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant