#378 Update commons-collection dependency to 4.1

[Mark Symons]

Upgrade commons-collections to v4.1 or later to mitigate level 9 threat.

Old name: commons-collections:commons-collections
Current name: org.apache.commons:commons-collections4

dbunit v2.5.x uses commons-collections:commons-collections v3.2.1

commons-collections4 v4.1 includes the critical security fix COLLECTIONS-580: Serialization support for unsafe classes in the functor package has been removed completely as this can be exploited for remote code execution attacks. Classes considered to be unsafe are:

• CloneTransformer
• ForClosure
• InstantiateFactory
• InstantiateTransformer
• InvokerTransformer
• PrototypeCloneFactory
• PrototypeSerializationFactory
• WhileClosure.

See:
Apache Commons statement to widespread Java object de-serialisation vulnerability
Release Notes for Apache Commons v4.1
What Do WebLogic, WebSphere, JBoss, Jenkins, OpenNMS, and Your Application Have in Common? This Vulnerability.

[Mark Symons]

The fix for the vulnerability is also available in commons-collections:commons-collections v3.2.2

dbUnit v2.5.3 uses commons-collections v3.2.2 (dbUnit v2.5.2 still used v3.2.1)

Thus, this defect can be marked as FIXED with a Fix Version of 2.5.3

[Jeff Jensen]

Thanks for updating! Closing...

[Deepak]

Though commons-collections 3.2 fixes this issue, can dbunit migrate to using commons-collections4 ? A new project that wants to use commons-collections will use the commons-collections4 artficat and not the older one. This causes both the old and the new artifacts to be present in the classpath and causes confusion.

[Jeff Jensen]

Hello Deepak, Please create a feature ticket for this. If you want it completed faster, please also create a merge request with the change (or attach a patch file to the ticket).