[BEANUTILS-489] You should upgrade dependendy on commons-collections to avoid CVE-2015-4852

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Duplicate
• Affects Version/s: 1.9.2
• Fix Version/s: 1.9.3
• Component/s: Locale BeanUtils / Converters

Environment

any

• Assignee: Unassigned
• Reporter: jandry
• Created: 20/May/16 08:15
• Updated: 23/May/16 20:54
• Resolved: 23/May/16 20:54

Description

You have fix CVE-2014-0114 in benutils 1.9.2 but you still have a dependency on commons-collections 3.2.1 which is well known for CVE-2015-4852
https://issues.apache.org/jira/browse/COLLECTIONS-583

You must upgrade dependency to 3.2.2

Issue Links

• duplicates: BEANUTILS-482 Update commons-collections from 3.2.1 to 3.2.2