Upgrade Apache Commons Collections to v3.2.2 #3

Merged
merged 1 commit into from May 12, 2016

Conversation

Projects
None yet
3 participants
@jart
Contributor

jart commented Apr 10, 2016

Version 3.2 has a CVSS 10.0 vulnerability. That's the worst kind of
vulnerability that exists. By merely existing on the classpath, this
library causes the Java serialization parser for the entire JVM process
to go from being a state machine to a turing machine. A turing machine
with an exec() function!

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8103
https://commons.apache.org/proper/commons-collections/security-reports.html
http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

Upgrade Apache Commons Collections to v3.2.2
Version 3.2 has a CVSS 10.0 vulnerability. That's the worst kind of
vulnerability that exists. By merely existing on the classpath, this
library causes the Java serialization parser for the entire JVM process
to go from being a state machine to a turing machine. A turing machine
with an exec() function!

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8103
https://commons.apache.org/proper/commons-collections/security-reports.html
http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
@retokromer

This comment has been minimized.

Show comment
Hide comment
@retokromer

retokromer May 6, 2016

Hmm… No one reading this pull request?

Hmm… No one reading this pull request?

@sdengineering77

This comment has been minimized.

Show comment
Hide comment
@sdengineering77

sdengineering77 May 11, 2016

Contributor

I'll have a look at it ASAP, thanks for the effort!

Contributor

sdengineering77 commented May 11, 2016

I'll have a look at it ASAP, thanks for the effort!

@sdengineering77

This comment has been minimized.

Show comment
Hide comment
@sdengineering77

sdengineering77 May 12, 2016

Contributor

Interesting isssue. Fortunately we don't provide external interfaces that deserialize incoming java objects in this project. I'll merge the pullrequest to make it future proof ofcourse. Thanks for pointing this out!

Contributor

sdengineering77 commented May 12, 2016

Interesting isssue. Fortunately we don't provide external interfaces that deserialize incoming java objects in this project. I'll merge the pullrequest to make it future proof ofcourse. Thanks for pointing this out!

@sdengineering77 sdengineering77 merged commit 7dc5222 into beeldengeluid:master May 12, 2016

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment