[jira] [Updated] (MDEP-531) MDP 2.10 depends on a known insecure library commons-collections:3.2.1

["Christian Schulte (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/MDEP-531?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Christian Schulte updated MDEP-531:
-----------------------------------
    Fix Version/s: 3.0

> MDP 2.10 depends on a known insecure library commons-collections:3.2.1
> ----------------------------------------------------------------------
>
>                 Key: MDEP-531
>                 URL: https://issues.apache.org/jira/browse/MDEP-531
>             Project: Maven Dependency Plugin
>          Issue Type: Bug
>    Affects Versions: 2.10
>            Reporter: Paul Farrar
>            Assignee: Christian Schulte
>             Fix For: 3.0
>
>
> org.apache.maven.plugins:maven-dependency-plugin:2.10 has the following dependency:
> {code}
>     <dependency>
>       <groupId>commons-collections</groupId>
>       <artifactId>commons-collections</artifactId>
>       <version>3.2.1</version>
>     </dependency>
> {code}
> This version of commons-collections has a known severe security vulnerability:
> https://www.kb.cert.org/vuls/id/576313
> https://commons.apache.org/proper/commons-collections/security-reports.html
> Please upgrade to a newer version of commons-collections as the insecure version is blocked for my usage.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)