Jasig/uPortal — pull request #404 by apetro (2014-08-12 19:34:46+00:00)
Title: UP-4205 CVE-2014-4172 Upgrade to Java CAS Client 3.3.2.

Upgrades uPortal `4.0-patches` to use Java CAS Client version `3.3.2`, which includes a fix for `CVE-201404172`.

Aggressively applies Maven excludes to keep the different transitive dependencies of Java CAS Client `3.3.2` (vs `3.2.1` previously used) out of the deployment.

Login seems to work.

Risks:
* Java CAS Client `3.3.2` depends on Servlet API 3 which is supported only in Tomcat 7 and later. uPortal 4.0.x up to this point has been trying to be Tomcat 6 compatible. Tomcat 6 adopters may be annoyed. Have not yet tested this to see whether it works anyway on Tomcat 6.

Is this the right fix for `4.0-patches` for a uPortal `4.0.15`?