Attaching patch which fixes this issue. Transitive dependencies in contrib/vertica and contrib/sqoop were pulling in commons-codec-1.2.jar, so I put explicit dependencies on commons-codec in their ivy.xml files to sync them to commons-codec-1.3.
Note that the original motivation for this issue is that Sqoop depends on commons-io-1.4 but seems to be the only component of Hadoop that does so. Therefore, without this patch, Sqoop will not execute from a binary-only release. After this patch, commons-io-1.4.jar is put in the output "lib" dir correctly.