[jira] [Created] (MDEP-531) MDP 2.10 depends on a known insecure library commons-collections:3.2.1

["Paul Farrar (JIRA)" <ji...@apache.org>]

Paul Farrar created MDEP-531:
--------------------------------

             Summary: MDP 2.10 depends on a known insecure library commons-collections:3.2.1
                 Key: MDEP-531
                 URL: https://issues.apache.org/jira/browse/MDEP-531
             Project: Maven Dependency Plugin
          Issue Type: Bug
    Affects Versions: 2.10
            Reporter: Paul Farrar


org.apache.maven.plugins:maven-dependency-plugin:2.10 has the following dependency:

{code}
    <dependency>
      <groupId>commons-collections</groupId>
      <artifactId>commons-collections</artifactId>
      <version>3.2.1</version>
    </dependency>
{code}

This version of commons-collections has a known severe security vulnerability:

https://www.kb.cert.org/vuls/id/576313
https://commons.apache.org/proper/commons-collections/security-reports.html

Please upgrade to a newer version of commons-collections as the insecure version is blocked for my usage.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)