Java Deserialization Vulnerability

Tom Zeller tzeller at dragonacea.biz
Fri Nov 20 17:19:12 EST 2015


> Does anybody know if commons-collections-3.2.1.jar can be removed? If so, what are the consequences? (I'm guessing a lot)

Probably not removed, but replaced with commons-collections-3.2.2.jar.

https://issues.apache.org/jira/browse/COLLECTIONS-580

https://issues.apache.org/jira/browse/VELOCITY-869


More information about the users mailing list