You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hbase.apache.org by ap...@apache.org on 2015/11/24 00:49:20 UTC
[3/6] hbase git commit: HBASE-14799 Commons-collections object
deserialization remote command execution vulnerability
HBASE-14799 Commons-collections object deserialization remote command execution vulnerability
Project: http://git-wip-us.apache.org/repos/asf/hbase/repo
Commit: http://git-wip-us.apache.org/repos/asf/hbase/commit/b71e1bce
Tree: http://git-wip-us.apache.org/repos/asf/hbase/tree/b71e1bce
Diff: http://git-wip-us.apache.org/repos/asf/hbase/diff/b71e1bce
Branch: refs/heads/branch-1
Commit: b71e1bce8677b35af69d13ceddf4a175b1ff79af
Parents: 4ff5a46
Author: Andrew Purtell <ap...@apache.org>
Authored: Mon Nov 23 13:37:19 2015 -0800
Committer: Andrew Purtell <ap...@apache.org>
Committed: Mon Nov 23 15:40:26 2015 -0800
----------------------------------------------------------------------
pom.xml | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/hbase/blob/b71e1bce/pom.xml
----------------------------------------------------------------------
diff --git a/pom.xml b/pom.xml
index d99e17c..8148b67 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1120,7 +1120,8 @@
<commons-math.version>2.2</commons-math.version>
<commons-net.version>3.1</commons-net.version>
<disruptor.version>3.3.0</disruptor.version>
- <collections.version>3.2.1</collections.version>
+ <!-- Do not use versions earlier than 3.2.2 due to a security vulnerability -->
+ <collections.version>3.2.2</collections.version>
<httpclient.version>3.1</httpclient.version>
<metrics-core.version>2.2.0</metrics-core.version>
<guava.version>12.0.1</guava.version>