[VALIDATOR-460] Update Apache Commons BeanUtils dependency from 1.9.3 to 1.9.4

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.6
• Fix Version/s: 1.7
• Assignee: Unassigned
• Reporter: Gary D. Gregory
• Created: 15/Oct/19 00:46
• Updated: 05/Nov/19 15:15
• Resolved: 15/Oct/19 00:50

Description

CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in bean introspection by default.

From BeanUtils:

The primary reason for this release is a bugfix for CVE-2014-0114. More specifically, our goal with BEANUTILS-520 is to set the default behaviour of the BeanUtilsBean to not allow class level access. The goal in doing this now is to bring 1.9.X into alignment with the same behaviour of the 2.X version line in regards to security. If one would like to opt out of the default behaviour, one could follow the example set out in the test class available in src/test/java/org/apache/commons/beanutils/bugs/Jira520TestCase.java.

Issue Links

• duplicates: VALIDATOR-458 commons-beanutils version 1.9.2 is having vulnerabilities upgrade it to the latest one