[ 
https://issues.apache.org/jira/browse/VELOCITY-869?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15018773#comment-15018773
 ] 

Ryan Blue commented on VELOCITY-869:
------------------------------------

Great, it sounds like Velocity's use wasn't a risk. But the way dependencies 
are handled in Java could easily mean that 3.2.1 gets included in the classpath 
and used instead of 3.2.2 in an application that would be vulnerable.

> Vulnerability in dependency: commons-collections:3.2.1
> ------------------------------------------------------
>
>                 Key: VELOCITY-869
>                 URL: https://issues.apache.org/jira/browse/VELOCITY-869
>             Project: Velocity
>          Issue Type: Bug
>          Components: Build
>    Affects Versions: 1.7
>            Reporter: Ryan Blue
>            Assignee: Sergiu Dumitriu
>             Fix For: 2.x, 1.x
>
>
> There is an arbitrary remote code execution bug in commons-collections, 
> tracked by COLLECTIONS-580. Updating to the version where this bug is fixed, 
> 3.2.2, will help downstream libraries (like avro-ipc) from pulling in the bad 
> version. Thanks!



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@velocity.apache.org
For additional commands, e-mail: dev-h...@velocity.apache.org

Reply via email to