[SM-2805] Vulnerable Apache Commons Collection still installed?

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 6.0.2, 6.1.0
• Fix Version/s: 6.0.4, 6.1.2

Environment

Any

• Assignee: Krzysztof Sobkowiak
• Reporter: Frank Joppe
• Created: 08/Jan/16 10:53
• Updated: 09/Jul/16 21:21
• Resolved: 24/Jun/16 21:01

Description

I have downloaded SMX6.1.0 from the front-page and I see that there is still a file "system/commons-collections/commons-collections/3.2.1/commons-collections-3.2.1.jar". I understand that this is still the version with the vulnarebility. Also if I list the packages from SMX 6.1.0, I see that package 178 is Commons Collections v3.2.1.

Do we still have the vulnarebility?