[SHIRO-576] Commons-beanutils dependency is not security compliant

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.3.0
• Fix Version/s: 1.3.3, 1.4.0-RC2
• Assignee: Unassigned
• Reporter: schnatterer
• Created: 27/Jul/16 08:52
• Updated: 13/Feb/17 18:52
• Resolved: 28/Sep/16 13:15

Description

Commons-beanutils v 1.8.0 dependency is not security compliant. Has issue CVE-2014-0114.

Note that current version commons-beanutils 1.9.2 in turn has a CVE in its dependency commons-collections (CVE-2015-6420, see BEANUTILS-488), which is fixed in 1.9.3.

In addition, consider including the OWASP Dependency Check to the build to find out about CVEs in dependencies faster.

Issue Links

• is duplicated by: SHIRO-612 Need to upgrade BeanUtils to avoid vulnerability
• links to: GitHub Pull Request #39