From 3bbcbaae9c52938fe8454ee50f908b8e06f2b49f Mon Sep 17 00:00:00 2001 From: Justine Tunney Date: Mon, 7 Mar 2016 17:12:48 -0500 Subject: [PATCH] Upgrade Apache Commons Collections to v3.2.2 Version 3.2.1 has a CVSS 10.0 vulnerability. That's the worst kind of vulnerability that exists. By merely existing on the classpath, this library causes the Java serialization parser for the entire JVM process to go from being a state machine to a turing machine. A turing machine with an exec() function! https://commons.apache.org/proper/commons-collections/security-reports.html http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/ --- gradle/javaprojects.gradle | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gradle/javaprojects.gradle b/gradle/javaprojects.gradle index 6445c28fbc..b519c2fb9f 100644 --- a/gradle/javaprojects.gradle +++ b/gradle/javaprojects.gradle @@ -17,7 +17,7 @@ ext.aspectjVersion = '1.8.4' ext.casClientVersion = '3.4.1' ext.cglibVersion = '3.1' ext.commonsCodecVersion = '1.10' -ext.commonsCollectionsVersion = '3.2.1' +ext.commonsCollectionsVersion = '3.2.2' ext.commonsLoggingVersion = '1.2' ext.ehcacheVersion = '2.9.0' ext.gebVersion = '0.10.0'