Import fixed Apache Commons Collections

[ikeyat]

Description

In commons-collections 3.2.1, arbitrary remote code execution vulnerability was found.
It was fixed 3.2.2.
https://issues.apache.org/jira/browse/COLLECTIONS-580

5.1.0.RELEASE is based on Spring IO Platform 2.0.0.RELEASE, but it contains commons-collection 3.2.1.

Spring 4 itself had similar vulnerability in older version. But fixed version (4.2.3 in IOPF 2.0.0.RELEASE #362 / 4.1.9 #392) will be imported in the next release.

Possible Solutions

Override its version to commons-collections 3.2.2.
It is necessary to backport to 1.0.x because of its impact.

Affects Version/s

• 5.0.1.RELEASE
• 1.0.3.RELEASE

Fix Version/s

• 5.1.0.RELEASE (will resolve via Upgrade to Spring IO Platform 2.0 #362)
• 5.0.2.RELEASE (will resolve via Update Spring IO Platform 1.1.5+ on 5.0.x line #392)
• 1.0.4.RELEASE

Issue Links

https://jvn.jp/vu/JVNVU94276522/
https://issues.apache.org/jira/browse/COLLECTIONS-580
https://jira.spring.io/browse/SPR-13656
#362

[btshimizukza]

@ikeyat

Spring IO Platform 2.0.x and 1.1.x will be fixed version of commons-collections at next maintenance release.

• http://docs.spring.io/platform/docs/2.0.1.BUILD-SNAPSHOT/reference/htmlsingle/#appendix-dependency-versions
• http://docs.spring.io/platform/docs/1.1.5.BUILD-SNAPSHOT/reference/htmlsingle/#appendix-dependency-versions

We need to watch these release timing.

[ikeyat]

@btshimizukza
Exactly yes. We would like to rely on IO Platform as possible.
In my idea, it should be replaced fixed one in RC1(begin of Jan.) even if IO Platform was not released.
Of course, we can switch to IO Platform after RC1 if it is released later.

[kazuki43zoo]

5.1.0 will resolved via #362 .

[ikeyat]

5.0.2 will be resolved via #392 .