Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-40130

Upgrade to version 3.2.2 of apache commons-collections

XMLWordPrintable

      This v3.2.2 release is a bugfix release, fixing several bugs present in the previous releases of the 3.2 branch. Additionally, this release provides a mitigation for a known remote code exploitation via the standard java object serialization mechanism. By default, serialization support for unsafe classes in the functor package is disabled and will result in an exception when either trying to serialize or de-serialize an instance of these classes. For more details, please refer to COLLECTIONS-580.

      https://commons.apache.org/proper/commons-collections/release_3_2_2.html

            [CONFSERVER-40130] Upgrade to version 3.2.2 of apache commons-collections

            David Black added a comment - - edited

            The commons-collections exploitation is rated as a level 9 threat by tools such as Sonatype Nexus Pro. It's great that the issue has been promptly fixed in Confluence, but shouldn't the priority be rated as major or critical? This would help support people when it comes to deciding whether they need to upgrade to v5.9.3 now - or wait for v5.9.4,

            msymons we have not treated upgrading the version of commons-collections as critical because only Confluence instances with a Data Center license are vulnerable through Hazelcast, which is used for clustering, and by default listens on port 5801. Ensure that you only permit cluster nodes to connect to a Confluence Data Center instance's Hazelcast port through the use of a firewall and/or network segregation.

            David Black added a comment - - edited The commons-collections exploitation is rated as a level 9 threat by tools such as Sonatype Nexus Pro. It's great that the issue has been promptly fixed in Confluence, but shouldn't the priority be rated as major or critical? This would help support people when it comes to deciding whether they need to upgrade to v5.9.3 now - or wait for v5.9.4, msymons we have not treated upgrading the version of commons-collections as critical because only Confluence instances with a Data Center license are vulnerable through Hazelcast , which is used for clustering, and by default listens on port 5801. Ensure that you only permit cluster nodes to connect to a Confluence Data Center instance's Hazelcast port through the use of a firewall and/or network segregation.

            Deleted Account (Inactive) added a comment -

            This issue is mentioned in commits included in the Confluence 6.0.0-OD-2016.01.1-0003 release being approved for production: CPU-180

            Deleted Account (Inactive) added a comment - This issue is mentioned in commits included in the Confluence 6.0.0-OD-2016.01.1-0003 release being approved for production: CPU-180

            Mark Symons added a comment -

            The commons-collections exploitation is rated as a level 9 threat by tools such as Sonatype Nexus Pro. It's great that the issue has been promptly fixed in Confluence, but shouldn't the priority be rated as major or critical? This would help support people when it comes to deciding whether they need to upgrade to v5.9.3 now - or wait for v5.9.4,

            Mark Symons added a comment - The commons-collections exploitation is rated as a level 9 threat by tools such as Sonatype Nexus Pro. It's great that the issue has been promptly fixed in Confluence, but shouldn't the priority be rated as major or critical? This would help support people when it comes to deciding whether they need to upgrade to v5.9.3 now - or wait for v5.9.4,

            Deleted Account (Inactive) added a comment -

            This issue is mentioned in commits included in the Confluence 6.0.0-OD-2016.01.1-0002 release being approved for production: CPU-179

            Deleted Account (Inactive) added a comment - This issue is mentioned in commits included in the Confluence 6.0.0-OD-2016.01.1-0002 release being approved for production: CPU-179

              fxu Feng Xu (Inactive)
              dblack David Black
              Affected customers:
              0 This affects my team
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: