From f553bcf469544d1973b9979a98e6e2a596170eb5 Mon Sep 17 00:00:00 2001
From: Andrew Purtell <apurtell@apache.org>
Date: Mon, 23 Nov 2015 13:37:19 -0800
Subject: [PATCH] HBASE-14799 Commons-collections object deserialization remote
 command execution vulnerability

---
 pom.xml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 9cfb311dc1b..d772c4bf94c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1176,7 +1176,8 @@
     <commons-math.version>2.2</commons-math.version>
     <commons-net.version>3.1</commons-net.version>
     <disruptor.version>3.3.0</disruptor.version>
-    <collections.version>3.2.1</collections.version>
+    <!-- Do not use versions earlier than 3.2.2 due to a security vulnerability -->
+    <collections.version>3.2.2</collections.version>
     <httpclient.version>3.1</httpclient.version>
     <metrics-core.version>2.2.0</metrics-core.version>
     <guava.version>12.0.1</guava.version>