shopizer-developers

Upgrade Apache Commons Collections Version 3.2.1 has a CVSS …

3/7/2016 7:08:55 PM

10.0 vulnerability. That's the worst kind of
vulnerability that exists. By merely existing on the classpath, this
library causes the Java serialization parser for the entire JVM process
to go from being a state machine to a turing machine. A turing machine
with an exec() function!

https://commons.apache.org/proper/commons-collections/security-reports.html
http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

Justine Tunney

Commit: dc2e734

Tree: b717811

Parents: fabe114

Changes

sm-core/pom.xml 2(+1 -1)

sm-core-model/pom.xml 2(+1 -1)

sm-shop/.classpath 6(+3 -3)

sm-shop/pom.xml 2(+1 -1)

Details

sm-core/pom.xml 2(+1 -1)

diff --git a/sm-core/pom.xml b/sm-core/pom.xml
index 989bcfa..6768c80 100755
--- a/sm-core/pom.xml
+++ b/sm-core/pom.xml
@@ -293,7 +293,7 @@
 		<dependency>
 			<groupId>commons-collections</groupId>
 			<artifactId>commons-collections</artifactId>
-			<version>3.2.1</version>
+			<version>3.2.2</version>
 	   </dependency>
 	   
 		<!-- Apache common -->

sm-core-model/pom.xml 2(+1 -1)

diff --git a/sm-core-model/pom.xml b/sm-core-model/pom.xml
index e0acb18..1c3051e 100755
--- a/sm-core-model/pom.xml
+++ b/sm-core-model/pom.xml
@@ -223,7 +223,7 @@
 		<dependency>
 			<groupId>commons-collections</groupId>
 			<artifactId>commons-collections</artifactId>
-			<version>3.2.1</version>
+			<version>3.2.2</version>
 		</dependency>
 
 		<!-- Apache common -->

sm-shop/.classpath 6(+3 -3)

diff --git a/sm-shop/.classpath b/sm-shop/.classpath
index fc1a514..d9d47b6 100644
--- a/sm-shop/.classpath
+++ b/sm-shop/.classpath
@@ -36,7 +36,7 @@
   <classpathentry kind="var" path="M2_REPO/net/sf/ehcache/ehcache/1.5.0/ehcache-1.5.0.jar" sourcepath="M2_REPO/net/sf/ehcache/ehcache/1.5.0/ehcache-1.5.0-sources.jar"/>
   <classpathentry kind="var" path="M2_REPO/backport-util-concurrent/backport-util-concurrent/3.1/backport-util-concurrent-3.1.jar" sourcepath="M2_REPO/backport-util-concurrent/backport-util-concurrent/3.1/backport-util-concurrent-3.1-sources.jar"/>
   <classpathentry kind="var" path="M2_REPO/commons-logging/commons-logging/1.1.1/commons-logging-1.1.1.jar" sourcepath="M2_REPO/commons-logging/commons-logging/1.1.1/commons-logging-1.1.1-sources.jar"/>
-  <classpathentry kind="var" path="M2_REPO/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar" sourcepath="M2_REPO/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1-sources.jar"/>
+  <classpathentry kind="var" path="M2_REPO/commons-collections/commons-collections/3.2.2/commons-collections-3.2.2.jar" sourcepath="M2_REPO/commons-collections/commons-collections/3.2.2/commons-collections-3.2.2-sources.jar"/>
   <classpathentry kind="var" path="M2_REPO/net/sf/jsr107cache/jsr107cache/1.0/jsr107cache-1.0.jar" sourcepath="M2_REPO/net/sf/jsr107cache/jsr107cache/1.0/jsr107cache-1.0-sources.jar"/>
   <classpathentry kind="var" path="M2_REPO/javassist/javassist/3.3/javassist-3.3.jar"/>
   <classpathentry kind="var" path="M2_REPO/com/mysema/querydsl/querydsl-core/3.4.2/querydsl-core-3.4.2.jar" sourcepath="M2_REPO/com/mysema/querydsl/querydsl-core/3.4.2/querydsl-core-3.4.2-sources.jar"/>
@@ -78,7 +78,7 @@
   <classpathentry kind="var" path="M2_REPO/org/freemarker/freemarker/2.3.19/freemarker-2.3.19.jar" sourcepath="M2_REPO/org/freemarker/freemarker/2.3.19/freemarker-2.3.19-sources.jar"/>
   <classpathentry kind="src" path="/sm-core-modules"/>
   <classpathentry kind="var" path="M2_REPO/com/shopizer/sm-search/0.0.5-SNAPSHOT/sm-search-0.0.5-SNAPSHOT.jar"/>
-  <classpathentry kind="var" path="M2_REPO/org/apache/commons/commons-collections4/4.0/commons-collections4-4.0.jar" sourcepath="M2_REPO/org/apache/commons/commons-collections4/4.0/commons-collections4-4.0-sources.jar"/>
+  <classpathentry kind="var" path="M2_REPO/org/apache/commons/commons-collections4/4.1/commons-collections4-4.1.jar" sourcepath="M2_REPO/org/apache/commons/commons-collections4/4.1/commons-collections4-4.1-sources.jar"/>
   <classpathentry kind="var" path="M2_REPO/org/slf4j/jcl-over-slf4j/1.6.6/jcl-over-slf4j-1.6.6.jar" sourcepath="M2_REPO/org/slf4j/jcl-over-slf4j/1.6.6/jcl-over-slf4j-1.6.6-sources.jar"/>
   <classpathentry kind="var" path="M2_REPO/org/elasticsearch/elasticsearch/1.5.2/elasticsearch-1.5.2.jar" sourcepath="M2_REPO/org/elasticsearch/elasticsearch/1.5.2/elasticsearch-1.5.2-sources.jar"/>
   <classpathentry kind="var" path="M2_REPO/org/apache/lucene/lucene-core/4.10.4/lucene-core-4.10.4.jar" sourcepath="M2_REPO/org/apache/lucene/lucene-core/4.10.4/lucene-core-4.10.4-sources.jar"/>
@@ -178,4 +178,4 @@
   <classpathentry kind="var" path="M2_REPO/org/jboss/jboss-common-core/2.2.14.GA/jboss-common-core-2.2.14.GA.jar" sourcepath="M2_REPO/org/jboss/jboss-common-core/2.2.14.GA/jboss-common-core-2.2.14.GA-sources.jar"/>
   <classpathentry kind="var" path="M2_REPO/org/jboss/logging/jboss-logging-spi/2.0.5.GA/jboss-logging-spi-2.0.5.GA.jar" sourcepath="M2_REPO/org/jboss/logging/jboss-logging-spi/2.0.5.GA/jboss-logging-spi-2.0.5.GA-sources.jar"/>
   <classpathentry kind="var" path="M2_REPO/net/tanesha/recaptcha4j/recaptcha4j/0.0.7/recaptcha4j-0.0.7.jar" sourcepath="M2_REPO/net/tanesha/recaptcha4j/recaptcha4j/0.0.7/recaptcha4j-0.0.7-sources.jar"/>
-</classpath>
\ No newline at end of file
+</classpath>

sm-shop/pom.xml 2(+1 -1)

diff --git a/sm-shop/pom.xml b/sm-shop/pom.xml
index 6385ad8..973f22b 100755
--- a/sm-shop/pom.xml
+++ b/sm-shop/pom.xml
@@ -274,7 +274,7 @@
 		<dependency>
 			<groupId>commons-collections</groupId>
 			<artifactId>commons-collections</artifactId>
-			<version>3.2.1</version>
+			<version>3.2.2</version>
 		</dependency>
 
 		<dependency>