| Package | Affected versions | Patched versions |
|---|---|---|
| commons-collections:commons-collections | < 3.2.2 | 3.2.2 |
| net.sourceforge.collections:collections-generic | = 4.01 | |
| org.apache.commons:commons-collections4 | < 4.1 | 4.1 |
| org.apache.servicemix.bundles:org.apache.servicemix.bundles.collections-generic | ≥ 4.01 | |
| org.apache.servicemix.bundles:org.apache.servicemix.bundles.commons-collections | ≥ 3.2.1 | |
| data grid | = 6.0.0 | |
| jboss a-mq | = 6.0.0 | |
| jboss bpm suite | = 6.0.0 | |
| jboss data virtualization | = 5.0.0= 6.0.0 | |
| jboss enterprise application platform | = 4.3.0= 5.0.0= 6.0.0 | |
| jboss enterprise brms platform | = 5.0.0= 6.0.0 | |
| jboss enterprise soa platform | = 5.0.0 | |
| jboss enterprise web server | = 3.0.0 | |
| jboss fuse | = 6.0.0 | |
| jboss fuse service works | = 6.0 | |
| jboss operations network | = 3.0 | |
| jboss portal | = 6.0.0 | |
| openshift | = 3.0 | |
| subscription asset manager | = 1.3.0 | |
| xpaas | = 3.0.0 |
It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free