jboss-integration/jboss-integration-platform-bom — pull request #129 by ryanzhang (2014-10-24 10:48:50+00:00)
Title: Remove common-httpclient-3.1 for CVE-2012-6153

Hi,
There is CVE reported in https://bugzilla.redhat.com/show_bug.cgi?id=1129916#c9
And noticed that it impacts brms/bpmsuite. We need to get rid of common-httpclient.
it should be updated to httpcomponets-httpclient 4.5.3 which has already been defined in jboss-integraiton-platform-bom.

This might also need droolsjbpm projects to remove the dependency on common-httpclient also since it is present in brms/bpmsuite 6.1:
find . -name "commons-httpclient*"
./jboss-eap-6.3/standalone/deployments/kie-execution-server.war/WEB-INF/lib/commons-httpclient-3.1.jar
./jboss-eap-6.3/modules/system/layers/bpms/org/apache/commons/httpclient/main/commons-httpclient-3.1.jar
./jboss-bpms-6.1.0.redhat-3-deployable-generic/jboss-bpms-engine/jboss-bpms-engine/lib/commons-httpclient-3.1.jar
./jboss-bpms-6.1.0.redhat-3-deployable-generic/jboss-bpms-manager/jboss-bpms-manager/standalone/deployments/kie-execution-server.war/WEB-INF/lib/commons-httpclient-3.1.jar
./jboss-bpms-6.1.0.redhat-3-deployable-generic/jboss-bpms-manager/jboss-bpms-manager/business-central.war/WEB-INF/lib/commons-httpclient-3.1.jar