sonatype/plexus-archiver — pull request #6 by mizdebsk (2013-04-12 11:44:43+00:00)
Title: Use apache-commons-compress for bzip2 compression/decompression

Plexus Archiver contains old bzip2 compression and decompression code
which is appearently forked from Apache Ant. The same code is
currently maintained as part of Apache Commons Compress.

The bundled bzip2 code is very outdated. It has several bugs, serious
performance problems, including CVE-2012-2098 vulnerability, which can
be used to cause denial of service.

To fix security vulnerability and prevent future problems bundled
bzip2 code is removed and replaced by calls to Apache Commons Compress
library.