[CONTROLLER-1454] [SECURITY] Upgrade commons-collections as a hardening measure

Thu, 19 Oct 2017 21:27:00 +0000

A vulnerability in commons-collections was recently discovered:

https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852
http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/#commons

OpenDaylight does not appear to expose any vector for deserializing arbitrary user-supplied content, therefore this vulnerability is not exploitable on OpenDaylight. As a hardening measure, we should consume a patched version of the library.

Randy Randhawa noted:

Looking into Beryllium sources, the only reference to commons-collections I can find is Karaf’s org.apache.karaf.demos.my-kar. Karaf still pulls in commons-collections 3.2.1 in the 3.x release train, though 4.x already upgraded: https://issues.apache.org/jira/browse/KARAF-4135. I pinged them about backporting the change.

OpenDaylight JIRA

[CONTROLLER-1454] [SECURITY] Upgrade commons-collections as a hardening measure