You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@commons.apache.org by Thomas Neidhart <th...@gmail.com> on 2015/11/15 23:23:20 UTC
[ANNOUNCMENT] Apache Commons Collections 3.2.2 Released
The Apache Commons team is pleased to announce the release of Apache
Commons Collections 3.2.2. The release is available for download at
http://commons.apache.org/proper/commons-collections/download_collections.cgi
Apache Commons Collections is a project to develop and maintain
collection classes based on and inspired by the JDK collection framework.
This Collections 3.2.2 release is a security and bugfix release, fixing
several bugs present in the previous releases of the 3.2 branch.
Additionally, this release provides a mitigation for a known remote code
exploitation via the standard java object serialization mechanism. By
default, serialization support for unsafe classes in the functor package
is disabled and will result in an exception when either trying to
serialize or de-serialize an instance of these classes. For more
details, please refer to COLLECTIONS-580.
All users are strongly encouraged to updated to this release.
See the release-notes at
http://commons.apache.org/proper/commons-collections/release_3_2_2.html
http://www.apache.org/dist/commons/collections/RELEASE-NOTES-3.2.2.txt
for a full list of changes.
Please verify signatures using the KEYS file available at the above
location when downloading the release.
For complete information on collections, including instructions on how
to submit bug reports, patches, or suggestions for improvement, see the
Apache Commons Collections website:
http://commons.apache.org/proper/commons-collections/
Thomas, on behalf of the Apache Commons team
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@commons.apache.org
For additional commands, e-mail: user-help@commons.apache.org
Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released
Posted by Thomas Neidhart <th...@gmail.com>.
On 11/15/2015 11:23 PM, Thomas Neidhart wrote:
should have been an ANNOUNCEMENT, but it's late, sorry.
Thomas
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released
Posted by Thomas Neidhart <th...@gmail.com>.
On 11/15/2015 11:23 PM, Thomas Neidhart wrote:
should have been an ANNOUNCEMENT, but it's late, sorry.
Thomas
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@commons.apache.org
For additional commands, e-mail: user-help@commons.apache.org
Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released
Posted by Phil Steitz <ph...@gmail.com>.
Thanks, Thomas!
Phil
On 11/15/15 3:23 PM, Thomas Neidhart wrote:
> The Apache Commons team is pleased to announce the release of Apache
> Commons Collections 3.2.2. The release is available for download at
>
>
> http://commons.apache.org/proper/commons-collections/download_collections.cgi
>
> Apache Commons Collections is a project to develop and maintain
> collection classes based on and inspired by the JDK collection framework.
>
> This Collections 3.2.2 release is a security and bugfix release, fixing
> several bugs present in the previous releases of the 3.2 branch.
>
> Additionally, this release provides a mitigation for a known remote code
> exploitation via the standard java object serialization mechanism. By
> default, serialization support for unsafe classes in the functor package
> is disabled and will result in an exception when either trying to
> serialize or de-serialize an instance of these classes. For more
> details, please refer to COLLECTIONS-580.
>
> All users are strongly encouraged to updated to this release.
>
> See the release-notes at
>
> http://commons.apache.org/proper/commons-collections/release_3_2_2.html
> http://www.apache.org/dist/commons/collections/RELEASE-NOTES-3.2.2.txt
>
> for a full list of changes.
>
> Please verify signatures using the KEYS file available at the above
> location when downloading the release.
>
> For complete information on collections, including instructions on how
> to submit bug reports, patches, or suggestions for improvement, see the
> Apache Commons Collections website:
>
> http://commons.apache.org/proper/commons-collections/
>
> Thomas, on behalf of the Apache Commons team
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released
Posted by Benedikt Ritter <br...@apache.org>.
I have the Debian builds still on my agenda but will not have the time to
work on that until end of the year.
2015-11-16 13:01 GMT+01:00 Emmanuel Bourg <eb...@apache.org>:
> Le 16/11/2015 12:33, Thomas Neidhart a écrit :
> > The problem is that the resulting manifest will be different for the ant
> > and maven builds (as for most other components).
>
> The manifest can be slightly different, I just need the Ant build to
> produce a jar without error, and the compiled classes inside of course :)
>
> Emmanuel Bourg
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
--
http://people.apache.org/~britter/
http://www.systemoutprintln.de/
http://twitter.com/BenediktRitter
http://github.com/britter
Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released
Posted by Emmanuel Bourg <eb...@apache.org>.
Le 16/11/2015 12:33, Thomas Neidhart a écrit :
> The problem is that the resulting manifest will be different for the ant
> and maven builds (as for most other components).
The manifest can be slightly different, I just need the Ant build to
produce a jar without error, and the compiled classes inside of course :)
Emmanuel Bourg
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released
Posted by Thomas Neidhart <th...@gmail.com>.
The problem is that the resulting manifest will be different for the ant
and maven builds (as for most other components).
Thomas
On Mon, Nov 16, 2015 at 12:18 PM, Emmanuel Bourg <eb...@apache.org> wrote:
> Le 16/11/2015 12:07, Thomas Neidhart a écrit :
> > Would it be much effort to switch to a maven-style build as it is done
> > already for the commons-lang3 package in debian?
>
> It isn't difficult but the issue is the backport to the previous Debian
> releases, the delta with the released versions should be minimal and a
> change of the build system is usually frowned upon.
>
> I'll just add back the manifest to the Debian package, but if another
> 3.2.x release has to be cut it would be nice to have the manifest back
> in the Apache Commons release.
>
> Emmanuel Bourg
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released
Posted by Emmanuel Bourg <eb...@apache.org>.
Le 16/11/2015 12:07, Thomas Neidhart a écrit :
> Would it be much effort to switch to a maven-style build as it is done
> already for the commons-lang3 package in debian?
It isn't difficult but the issue is the backport to the previous Debian
releases, the delta with the released versions should be minimal and a
change of the build system is usually frowned upon.
I'll just add back the manifest to the Debian package, but if another
3.2.x release has to be cut it would be nice to have the manifest back
in the Apache Commons release.
Emmanuel Bourg
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released
Posted by Thomas Neidhart <th...@gmail.com>.
Would it be much effort to switch to a maven-style build as it is done
already for the commons-lang3 package in debian?
This release of commons-collections 3.2.2 depends on the latest
commons-parent, so the build should be pretty much the same as for lang
(especially as there are no special plugins configured).
Thomas
On Mon, Nov 16, 2015 at 11:46 AM, Thomas Neidhart <thomas.neidhart@gmail.com
> wrote:
> Hi,
>
> I did not test the ant build, but I explicitly removed the MANIFEST.MF as
> this has to be created by the relevant plugins as setup in the
> commons-parent.pom (especially for proper OSGI metadata).
>
> I will take a look this evening how to mitigate this.
>
> Thomas
>
> On Mon, Nov 16, 2015 at 11:19 AM, Emmanuel Bourg <eb...@apache.org>
> wrote:
>
>> Thank you for driving this update Thomas. I noticed too late that
>> src/conf/MANIFEST.MF is missing from the sources, this breaks the Ant
>> build (which is still used in Debian).
>>
>> Emmanuel Bourg
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
>> For additional commands, e-mail: dev-help@commons.apache.org
>>
>>
>
Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released
Posted by Thomas Neidhart <th...@gmail.com>.
Hi,
I did not test the ant build, but I explicitly removed the MANIFEST.MF as
this has to be created by the relevant plugins as setup in the
commons-parent.pom (especially for proper OSGI metadata).
I will take a look this evening how to mitigate this.
Thomas
On Mon, Nov 16, 2015 at 11:19 AM, Emmanuel Bourg <eb...@apache.org> wrote:
> Thank you for driving this update Thomas. I noticed too late that
> src/conf/MANIFEST.MF is missing from the sources, this breaks the Ant
> build (which is still used in Debian).
>
> Emmanuel Bourg
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released
Posted by Emmanuel Bourg <eb...@apache.org>.
Thank you for driving this update Thomas. I noticed too late that
src/conf/MANIFEST.MF is missing from the sources, this breaks the Ant
build (which is still used in Debian).
Emmanuel Bourg
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: [ANNOUNCMENT] Apache Commons Collections 3.2.2 Released
Posted by Gary Gregory <ga...@gmail.com>.
Thank you for pushing this release through Thomas!
Gary
On Nov 15, 2015 2:23 PM, "Thomas Neidhart" <th...@gmail.com>
wrote:
> The Apache Commons team is pleased to announce the release of Apache
> Commons Collections 3.2.2. The release is available for download at
>
>
>
> http://commons.apache.org/proper/commons-collections/download_collections.cgi
>
> Apache Commons Collections is a project to develop and maintain
> collection classes based on and inspired by the JDK collection framework.
>
> This Collections 3.2.2 release is a security and bugfix release, fixing
> several bugs present in the previous releases of the 3.2 branch.
>
> Additionally, this release provides a mitigation for a known remote code
> exploitation via the standard java object serialization mechanism. By
> default, serialization support for unsafe classes in the functor package
> is disabled and will result in an exception when either trying to
> serialize or de-serialize an instance of these classes. For more
> details, please refer to COLLECTIONS-580.
>
> All users are strongly encouraged to updated to this release.
>
> See the release-notes at
>
>
> http://commons.apache.org/proper/commons-collections/release_3_2_2.html
>
> http://www.apache.org/dist/commons/collections/RELEASE-NOTES-3.2.2.txt
>
> for a full list of changes.
>
> Please verify signatures using the KEYS file available at the above
> location when downloading the release.
>
> For complete information on collections, including instructions on how
> to submit bug reports, patches, or suggestions for improvement, see the
> Apache Commons Collections website:
>
> http://commons.apache.org/proper/commons-collections/
>
> Thomas, on behalf of the Apache Commons team
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>