From 480138b5c59bf8db1e19c118e393a24a2d4a7dce Mon Sep 17 00:00:00 2001
From: Ben Stewart <bst@google.com>
Date: Tue, 8 Mar 2016 16:43:11 -0800
Subject: [PATCH] Upgrade Apache Commons Collections to v3.2.2

Version 3.2.1 has a CVSS 10.0 vulnerability. That's the worst kind of
vulnerability that exists. By merely existing on the classpath, this
library causes the Java serialization parser for the entire JVM process
to go from being a state machine to a turing machine. A turing machine
with an exec() function!

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8103
https://commons.apache.org/proper/commons-collections/security-reports.html
http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
---
 Chapter03/pom.xml                 | 2 +-
 Chapter03/sensor-data.iml         | 2 +-
 Chapter06/ai.iml                  | 2 +-
 Chapter06/pom.xml                 | 2 +-
 Chapter07/analytics.iml           | 4 ++--
 Chapter07/financial-analytics.iml | 4 ++--
 Chapter07/pom.xml                 | 2 +-
 Chapter08/nlp.iml                 | 4 ++--
 Chapter08/pom.xml                 | 2 +-
 Chapter09/advertising.iml         | 2 +-
 Chapter09/pom.xml                 | 2 +-
 11 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/Chapter03/pom.xml b/Chapter03/pom.xml
index d4c63c0..83d14a5 100644
--- a/Chapter03/pom.xml
+++ b/Chapter03/pom.xml
@@ -42,7 +42,7 @@
         <dependency>
             <groupId>commons-collections</groupId>
             <artifactId>commons-collections</artifactId>
-            <version>3.2.1</version>
+            <version>3.2.2</version>
         </dependency>
     </dependencies>
 
diff --git a/Chapter03/sensor-data.iml b/Chapter03/sensor-data.iml
index a7693d4..f69be8c 100644
--- a/Chapter03/sensor-data.iml
+++ b/Chapter03/sensor-data.iml
@@ -62,7 +62,7 @@
     <orderEntry type="library" name="Maven: ch.qos.logback:logback-core:1.0.6" level="project" />
     <orderEntry type="library" name="Maven: org.slf4j:log4j-over-slf4j:1.6.6" level="project" />
     <orderEntry type="library" name="Maven: io.netty:netty:3.6.3.Final" level="project" />
-    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.1" level="project" />
+    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.2" level="project" />
   </component>
 </module>
 
diff --git a/Chapter06/ai.iml b/Chapter06/ai.iml
index 8dcbdc1..9b4998d 100644
--- a/Chapter06/ai.iml
+++ b/Chapter06/ai.iml
@@ -66,7 +66,7 @@
     <orderEntry type="library" scope="PROVIDED" name="Maven: org.slf4j:log4j-over-slf4j:1.6.6" level="project" />
     <orderEntry type="library" scope="PROVIDED" name="Maven: storm:storm-netty:0.9.0.1" level="project" />
     <orderEntry type="library" scope="PROVIDED" name="Maven: io.netty:netty:3.6.3.Final" level="project" />
-    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.1" level="project" />
+    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.2" level="project" />
     <orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-core:2.1.4" level="project" />
     <orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-annotations:2.1.4" level="project" />
     <orderEntry type="library" scope="TEST" name="Maven: org.hamcrest:hamcrest-core:1.1" level="project" />
diff --git a/Chapter06/pom.xml b/Chapter06/pom.xml
index bd9ed40..9342de0 100644
--- a/Chapter06/pom.xml
+++ b/Chapter06/pom.xml
@@ -38,7 +38,7 @@
         <dependency>
             <groupId>commons-collections</groupId>
             <artifactId>commons-collections</artifactId>
-            <version>3.2.1</version>
+            <version>3.2.2</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
diff --git a/Chapter07/analytics.iml b/Chapter07/analytics.iml
index 1ceb280..f86be61 100644
--- a/Chapter07/analytics.iml
+++ b/Chapter07/analytics.iml
@@ -154,8 +154,8 @@
     <orderEntry type="library" name="Maven: com.github.stephenc.eaio-uuid:uuid:3.2.0" level="project" />
     <orderEntry type="library" name="Maven: org.codehaus.jettison:jettison:1.3.1" level="project" />
     <orderEntry type="library" name="Maven: stax:stax-api:1.0.1" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.directory.studio:org.apache.commons.collections:3.2.1" level="project" />
-    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.1" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.directory.studio:org.apache.commons.collections:3.2.2" level="project" />
+    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.2" level="project" />
     <orderEntry type="library" name="Maven: kafka:core-kafka:0.7.2-mmx1" level="project" />
     <orderEntry type="library" name="Maven: com.github.sgroschupf:zkclient:0.1" level="project" />
     <orderEntry type="library" name="Maven: net.sf.jopt-simple:jopt-simple:3.2" level="project" />
diff --git a/Chapter07/financial-analytics.iml b/Chapter07/financial-analytics.iml
index 1ceb280..f86be61 100644
--- a/Chapter07/financial-analytics.iml
+++ b/Chapter07/financial-analytics.iml
@@ -154,8 +154,8 @@
     <orderEntry type="library" name="Maven: com.github.stephenc.eaio-uuid:uuid:3.2.0" level="project" />
     <orderEntry type="library" name="Maven: org.codehaus.jettison:jettison:1.3.1" level="project" />
     <orderEntry type="library" name="Maven: stax:stax-api:1.0.1" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.directory.studio:org.apache.commons.collections:3.2.1" level="project" />
-    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.1" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.directory.studio:org.apache.commons.collections:3.2.2" level="project" />
+    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.2" level="project" />
     <orderEntry type="library" name="Maven: kafka:core-kafka:0.7.2-mmx1" level="project" />
     <orderEntry type="library" name="Maven: com.github.sgroschupf:zkclient:0.1" level="project" />
     <orderEntry type="library" name="Maven: net.sf.jopt-simple:jopt-simple:3.2" level="project" />
diff --git a/Chapter07/pom.xml b/Chapter07/pom.xml
index 69f2474..ff47f87 100644
--- a/Chapter07/pom.xml
+++ b/Chapter07/pom.xml
@@ -56,7 +56,7 @@
         <dependency>
             <groupId>commons-collections</groupId>
             <artifactId>commons-collections</artifactId>
-            <version>3.2.1</version>
+            <version>3.2.2</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
diff --git a/Chapter08/nlp.iml b/Chapter08/nlp.iml
index f643f1f..15a5862 100644
--- a/Chapter08/nlp.iml
+++ b/Chapter08/nlp.iml
@@ -155,8 +155,8 @@
     <orderEntry type="library" name="Maven: com.github.stephenc.eaio-uuid:uuid:3.2.0" level="project" />
     <orderEntry type="library" name="Maven: org.codehaus.jettison:jettison:1.3.1" level="project" />
     <orderEntry type="library" name="Maven: stax:stax-api:1.0.1" level="project" />
-    <orderEntry type="library" name="Maven: org.apache.directory.studio:org.apache.commons.collections:3.2.1" level="project" />
-    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.1" level="project" />
+    <orderEntry type="library" name="Maven: org.apache.directory.studio:org.apache.commons.collections:3.2.2" level="project" />
+    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.2" level="project" />
     <orderEntry type="library" name="Maven: kafka:core-kafka:0.7.2-mmx1" level="project" />
     <orderEntry type="library" name="Maven: com.github.sgroschupf:zkclient:0.1" level="project" />
     <orderEntry type="library" name="Maven: net.sf.jopt-simple:jopt-simple:3.2" level="project" />
diff --git a/Chapter08/pom.xml b/Chapter08/pom.xml
index 70f1435..cad315b 100644
--- a/Chapter08/pom.xml
+++ b/Chapter08/pom.xml
@@ -61,7 +61,7 @@
         <dependency>
             <groupId>commons-collections</groupId>
             <artifactId>commons-collections</artifactId>
-            <version>3.2.1</version>
+            <version>3.2.2</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
diff --git a/Chapter09/advertising.iml b/Chapter09/advertising.iml
index 60ea79c..17271d2 100644
--- a/Chapter09/advertising.iml
+++ b/Chapter09/advertising.iml
@@ -66,7 +66,7 @@
     <orderEntry type="library" name="Maven: org.slf4j:log4j-over-slf4j:1.6.6" level="project" />
     <orderEntry type="library" name="Maven: storm:storm-netty:0.9.0.1" level="project" />
     <orderEntry type="library" name="Maven: io.netty:netty:3.6.3.Final" level="project" />
-    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.1" level="project" />
+    <orderEntry type="library" name="Maven: commons-collections:commons-collections:3.2.2" level="project" />
     <orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-core:2.1.4" level="project" />
     <orderEntry type="library" name="Maven: com.fasterxml.jackson.core:jackson-annotations:2.1.4" level="project" />
   </component>
diff --git a/Chapter09/pom.xml b/Chapter09/pom.xml
index 909f046..575c833 100644
--- a/Chapter09/pom.xml
+++ b/Chapter09/pom.xml
@@ -38,7 +38,7 @@
         <dependency>
             <groupId>commons-collections</groupId>
             <artifactId>commons-collections</artifactId>
-            <version>3.2.1</version>
+            <version>3.2.2</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>