Commits on Mar 5, 2016

1. Upgrade Apache Commons Collections to v3.2.2 …

   Version 3.2.1 has a CVSS 10.0 vulnerability. That's the worst kind of
   vulnerability that exists. By merely existing on the classpath, this
   library causes the Java serialization parser for the entire JVM process
   to go from being a state machine to a turing machine. A turing machine
   with an exec() function!
   
   https://commons.apache.org/proper/commons-collections/security-reports.html
   http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

   

   jart committed Mar 5, 2016
   Configuration menu

   • View commit details
   • Copy full SHA for 2067d9b
   • Browse repository at this point

   Copy the full SHA

   2067d9b View commit details

   Browse the repository at this point in the history