Project: mule
Issue MULE-9060: Update commons-collections version
The Apache commons-collections library (4.0, 3.2.1 and older) has a vulnerability in the InvokerTransformer object where serializable collections are allowed to execute arbitrary Java code, whenever the library is in the classpath. If we have an endpoint that receives a serializable object, that object can invoke arbitrary Java code at the moment we try to deserialize it. We should upgrade to the fixed version (3.2.2) as soon as it's available or remove the class from our classpath.
Story points: 3