PH48009: SECURITY HARDENING: APACHE COMMONS COLLECTIONS

APAR status

• Closed as program error.

Error description

• Update Apache Commons Collections to '3.2.2'. The current
  version is '3.2.1'+ and contains patches for reported security
  issues. This update is a version hardening to '3.2.2'
  
  
  
  There
  is not a known security vulnerability being addressed with this
  update. As previously stated, I confirmed that the current
  Commons Collections we ship does contain the security
  vulnerability fix for CVE-2015-7450 already.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: Harden Apache Commons Collections to    *
  *                      version 3.2.2                           *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  This update is a security hardening for the Apache Commons
  Collections bundle. There is no known security vulnerability
  being addressed with this update.
  

Problem conclusion

• The fix for this APAR update the apache commons-collections
  packages in the WebSphere plugins and runtime.
  
  This fix is currently targeted for WebSphere Application
  Server 9.0.5.14 & 8.5.5.23. For
  more information, see 'Recommended Updates for WebSphere
  Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels