[
https://issues.apache.org/jira/browse/HADOOP-12577?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15018762#comment-15018762
]
David Villegas commented on HADOOP-12577:
-----------------------------------------
Hi,
I am no security expert, but from the link it seems Hadoop does not need to use
any of these classes to be vulnerable. They just need to be in the classpath,
and the exploit will dynamically load them during deserialization. Also, as
it's pointed out elsewhere, commons-collections is just an example of how Java
deserialization can be exploited, and a more thorough solution to this would be
to ensure Hadoop does not do object deserialization from untrusted sources. It
seems things like RMI, JMX, JMS and other IPC mechanisms could be exploitable
using this technique.
> Bump up commons-collections version to 3.2.2 to address a security flaw
> -----------------------------------------------------------------------
>
> Key: HADOOP-12577
> URL: https://issues.apache.org/jira/browse/HADOOP-12577
> Project: Hadoop Common
> Issue Type: Bug
> Components: build, security
> Affects Versions: 2.7.1, 2.6.2
> Reporter: Wei-Chiu Chuang
> Assignee: Wei-Chiu Chuang
> Priority: Blocker
> Attachments: HADOOP-12577.001.patch
>
>
> Update commons-collections from 3.2.1 to 3.2.2 because of a major security
> vulnerability. There are many other open source projects use
> commons-collections and are also affected.
> Please see
> http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/
> for the discovery of the vulnerability.
> https://issues.apache.org/jira/browse/COLLECTIONS-580 has the discussion
> thread of the fix.
> https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread
> The ASF response to the security vulnerability.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
