[
https://issues.apache.org/jira/browse/CLOUDSTACK-9053?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15012158#comment-15012158
]
ASF GitHub Bot commented on CLOUDSTACK-9053:
--------------------------------------------
GitHub user DaanHoogland opened a pull request:
https://github.com/apache/cloudstack/pull/1088
CLOUDSTACK-9053 security upgrade as per COLLECTIONS-580
cloustack is not vulnerable but as the classes are in they might
be used in the future so we upgrade to prevent accidental
vulnerabilities.
build, unit tested and starting regression tests on it now
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/DaanHoogland/cloudstack CLOUDSTACK-9053
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/cloudstack/pull/1088.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #1088
----
commit 67da6974250459f78dbe2a8e11bee6ea6278e6b4
Author: Daan Hoogland <d...@onecht.net>
Date: 2015-11-18T21:54:25Z
CLOUDSTACK-9053 security upgrade as per COLLECTIONS-580
cloustack is not vulnerable but as the classes are in they might
be used in the future so we upgrade to prevent accidental
vulnerabilities.
----
> CloudStack is dependent upon a vulnerable version of Commons Collections
> ------------------------------------------------------------------------
>
> Key: CLOUDSTACK-9053
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-9053
> Project: CloudStack
> Issue Type: Bug
> Security Level: Public(Anyone can view this level - this is the
> default.)
> Reporter: John Kinsella
>
> COLLECTIONS-580 was brought to our attention today. Current versions of
> Apache Commons Collections contain a serialization/unserialization
> vulnerability which may result in remote code execution.
> CloudStack does not seem to use the specific vulnerable class
> InvokerTransformer, so in theory we could recommend pulling that class from
> the jars/wars, but still looking to see what else we can do...
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
