{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Critical",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update for the Apache Commons Collections component that fixes one\nsecurity issue is now available from the Red Hat Customer Portal for Red\nHat JBoss SOA Platform 5.3.1.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Apache Commons Collections is a library built upon Java JDK classes by\nproviding new interfaces, implementations and utilities.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of Red Hat JBoss SOA Platform 5.3.1 as provided from the Red Hat\nCustomer Portal are advised to apply this security update.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2015:2516",
            url: "https://access.redhat.com/errata/RHSA-2015:2516",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#critical",
            url: "https://access.redhat.com/security/updates/classification/#critical",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=securityPatches&version=5.3.1+GA",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform&downloadType=securityPatches&version=5.3.1+GA",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/solutions/2045023",
            url: "https://access.redhat.com/solutions/2045023",
         },
         {
            category: "external",
            summary: "1279330",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2516.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat JBoss SOA Platform 5.3.1 commons-collections security update",
      tracking: {
         current_release_date: "2024-12-15T18:41:27+00:00",
         generator: {
            date: "2024-12-15T18:41:27+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.3",
            },
         },
         id: "RHSA-2015:2516",
         initial_release_date: "2015-11-25T20:37:38+00:00",
         revision_history: [
            {
               date: "2015-11-25T20:37:38+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-02-20T12:37:02+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-12-15T18:41:27+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat JBoss SOA Platform 5.3",
                        product: {
                           name: "Red Hat JBoss SOA Platform 5.3",
                           product_id: "Red Hat JBoss SOA Platform 5.3",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_enterprise_soa_platform:5.3",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat JBoss SOA Platform",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2015-7501",
         cwe: {
            id: "CWE-284",
            name: "Improper Access Control",
         },
         discovery_date: "2015-11-06T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1279330",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "apache-commons-collections: InvokerTransformer code execution during deserialisation",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss SOA Platform 5.3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2015-7501",
            },
            {
               category: "external",
               summary: "RHBZ#1279330",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
            },
            {
               category: "external",
               summary: "RHSB-2045023",
               url: "https://access.redhat.com/solutions/2045023",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2015-7501",
               url: "https://www.cve.org/CVERecord?id=CVE-2015-7501",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
            },
            {
               category: "external",
               summary: "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
               url: "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
            },
         ],
         release_date: "2015-11-06T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-11-25T20:37:38+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss SOA Platform installation (including its databases,\napplications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss SOA Platform server\nby stopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the Red Hat JBoss SOA\nPlatform server by starting the JBoss Application Server process.",
               product_ids: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:2516",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss SOA Platform 5.3",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Critical",
            },
         ],
         title: "apache-commons-collections: InvokerTransformer code execution during deserialisation",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Updated jakarta-commons-collections packages that fix one security issue\nare now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "The Jakarta/Apache Commons Collections library provides new interfaces,\nimplementations, and utilities to extend the features of the Java\nCollections Framework.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nWith this update, deserialization of certain classes in the\ncommons-collections library is no longer allowed. Applications that require\nthose classes to be deserialized can use the system property\n\"org.apache.commons.collections.enableUnsafeSerialization\" to re-enable\ntheir deserialization.\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of jakarta-commons-collections are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this issue.\nAll running applications using the commons-collections library must be\nrestarted for the update to take effect.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2015:2521",
            url: "https://access.redhat.com/errata/RHSA-2015:2521",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/solutions/2045023",
            url: "https://access.redhat.com/solutions/2045023",
         },
         {
            category: "external",
            summary: "1279330",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2521.json",
         },
      ],
      title: "Red Hat Security Advisory: jakarta-commons-collections security update",
      tracking: {
         current_release_date: "2024-12-15T18:41:38+00:00",
         generator: {
            date: "2024-12-15T18:41:38+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.3",
            },
         },
         id: "RHSA-2015:2521",
         initial_release_date: "2015-11-30T04:40:14+00:00",
         revision_history: [
            {
               date: "2015-11-30T04:40:14+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2015-11-30T04:40:14+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-12-15T18:41:38+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux Desktop Optional (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux Desktop Optional (v. 6)",
                           product_id: "6Client-optional-6.7.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::client",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux HPC Node Optional (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux HPC Node Optional (v. 6)",
                           product_id: "6ComputeNode-optional-6.7.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::computenode",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux Server (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux Server (v. 6)",
                           product_id: "6Server-6.7.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::server",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux Server Optional (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux Server Optional (v. 6)",
                           product_id: "6Server-optional-6.7.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::server",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux Workstation (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux Workstation (v. 6)",
                           product_id: "6Workstation-6.7.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::workstation",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux Workstation Optional (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux Workstation Optional (v. 6)",
                           product_id: "6Workstation-optional-6.7.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::workstation",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Enterprise Linux",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                        product: {
                           name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                           product_id: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/jakarta-commons-collections@3.2.1-3.5.el6_7?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                        product: {
                           name: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                           product_id: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/jakarta-commons-collections-javadoc@3.2.1-3.5.el6_7?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                        product: {
                           name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                           product_id: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/jakarta-commons-collections@3.2.1-3.5.el6_7?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                        product: {
                           name: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                           product_id: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/jakarta-commons-collections-testframework@3.2.1-3.5.el6_7?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                        product: {
                           name: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                           product_id: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/jakarta-commons-collections-testframework-javadoc@3.2.1-3.5.el6_7?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                        product: {
                           name: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                           product_id: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/jakarta-commons-collections-tomcat5@3.2.1-3.5.el6_7?arch=noarch",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Client-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
            },
            product_reference: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
            relates_to_product_reference: "6Client-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Client-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Client-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Client-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Client-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6ComputeNode-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
            },
            product_reference: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
            relates_to_product_reference: "6ComputeNode-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6ComputeNode-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6ComputeNode-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6ComputeNode-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6ComputeNode-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Server-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
            },
            product_reference: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
            relates_to_product_reference: "6Server-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Server-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Server-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Server-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Server-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Server-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
            },
            product_reference: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
            relates_to_product_reference: "6Server-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Server-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Server-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Server-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Server-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Workstation-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
            },
            product_reference: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
            relates_to_product_reference: "6Workstation-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Workstation-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Workstation-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Workstation-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Workstation-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Workstation-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
            },
            product_reference: "jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
            relates_to_product_reference: "6Workstation-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Workstation-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Workstation-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Workstation-optional-6.7.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            },
            product_reference: "jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            relates_to_product_reference: "6Workstation-optional-6.7.z",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2015-7501",
         cwe: {
            id: "CWE-284",
            name: "Improper Access Control",
         },
         discovery_date: "2015-11-06T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1279330",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "apache-commons-collections: InvokerTransformer code execution during deserialisation",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Client-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
               "6Client-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
               "6Client-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
               "6Client-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
               "6Client-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
               "6Client-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
               "6ComputeNode-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
               "6ComputeNode-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
               "6ComputeNode-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
               "6ComputeNode-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
               "6ComputeNode-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
               "6ComputeNode-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
               "6Server-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
               "6Server-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
               "6Server-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
               "6Server-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
               "6Server-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
               "6Server-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
               "6Server-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
               "6Server-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
               "6Server-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
               "6Server-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
               "6Server-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
               "6Server-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
               "6Workstation-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
               "6Workstation-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
               "6Workstation-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
               "6Workstation-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
               "6Workstation-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
               "6Workstation-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
               "6Workstation-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
               "6Workstation-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
               "6Workstation-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
               "6Workstation-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
               "6Workstation-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
               "6Workstation-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2015-7501",
            },
            {
               category: "external",
               summary: "RHBZ#1279330",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
            },
            {
               category: "external",
               summary: "RHSB-2045023",
               url: "https://access.redhat.com/solutions/2045023",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2015-7501",
               url: "https://www.cve.org/CVERecord?id=CVE-2015-7501",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
            },
            {
               category: "external",
               summary: "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
               url: "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
            },
         ],
         release_date: "2015-11-06T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-11-30T04:40:14+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "6Client-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                  "6Client-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                  "6Client-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Client-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                  "6Client-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Client-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                  "6ComputeNode-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                  "6ComputeNode-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                  "6ComputeNode-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6ComputeNode-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                  "6ComputeNode-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6ComputeNode-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                  "6Server-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                  "6Server-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                  "6Workstation-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                  "6Workstation-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:2521",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               products: [
                  "6Client-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                  "6Client-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                  "6Client-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Client-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                  "6Client-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Client-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                  "6ComputeNode-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                  "6ComputeNode-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                  "6ComputeNode-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6ComputeNode-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                  "6ComputeNode-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6ComputeNode-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                  "6Server-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                  "6Server-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Server-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                  "6Workstation-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-optional-6.7.z:jakarta-commons-collections-0:3.2.1-3.5.el6_7.src",
                  "6Workstation-optional-6.7.z:jakarta-commons-collections-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-optional-6.7.z:jakarta-commons-collections-testframework-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-optional-6.7.z:jakarta-commons-collections-testframework-javadoc-0:3.2.1-3.5.el6_7.noarch",
                  "6Workstation-optional-6.7.z:jakarta-commons-collections-tomcat5-0:3.2.1-3.5.el6_7.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Critical",
            },
         ],
         title: "apache-commons-collections: InvokerTransformer code execution during deserialisation",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Critical",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update for the Apache Commons Collections component that fixes one\nsecurity issue is now available from the Red Hat Customer Portal for Red\nHat JBoss Operations Network 3.3 update 4.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Apache Commons Collections is a library built upon Java JDK classes by\nproviding new interfaces, implementations and utilities.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of JBoss Operations Network 3.3.4 as provided from the Red Hat\nCustomer Portal are advised to apply this security update.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2015:2524",
            url: "https://access.redhat.com/errata/RHSA-2015:2524",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#critical",
            url: "https://access.redhat.com/security/updates/classification/#critical",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em&downloadType=securityPatches&version=3.3",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=em&downloadType=securityPatches&version=3.3",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/solutions/2045023",
            url: "https://access.redhat.com/solutions/2045023",
         },
         {
            category: "external",
            summary: "1279330",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2524.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat JBoss Operations Network 3.3.4 security update",
      tracking: {
         current_release_date: "2024-12-15T18:41:16+00:00",
         generator: {
            date: "2024-12-15T18:41:16+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.3",
            },
         },
         id: "RHSA-2015:2524",
         initial_release_date: "2015-11-30T16:07:35+00:00",
         revision_history: [
            {
               date: "2015-11-30T16:07:35+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-02-20T12:36:18+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-12-15T18:41:16+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat JBoss Operations Network 3.3",
                        product: {
                           name: "Red Hat JBoss Operations Network 3.3",
                           product_id: "Red Hat JBoss Operations Network 3.3",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_operations_network:3.3",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat JBoss Operations Network",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2015-7501",
         cwe: {
            id: "CWE-284",
            name: "Improper Access Control",
         },
         discovery_date: "2015-11-06T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1279330",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "apache-commons-collections: InvokerTransformer code execution during deserialisation",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss Operations Network 3.3",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2015-7501",
            },
            {
               category: "external",
               summary: "RHBZ#1279330",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
            },
            {
               category: "external",
               summary: "RHSB-2045023",
               url: "https://access.redhat.com/solutions/2045023",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2015-7501",
               url: "https://www.cve.org/CVERecord?id=CVE-2015-7501",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
            },
            {
               category: "external",
               summary: "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
               url: "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
            },
         ],
         release_date: "2015-11-06T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-11-30T16:07:35+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). This is a server patch that contains a\nsingle fix and should not be mixed with other server patches. If you\nalready have a server patch, please contact Red Hat Global Support Services\nfor compatibility assessment.\n\nYou must shutdown the JBoss ON server prior to applying this patch.\n\nThis patch must be applied to each JBoss ON server in a high-availability\n(HA) environment. You can apply the patch to each server individually so\nthat only one server is down at a time.\n\nTo install the patch:\n\n1. Stop the JBoss ON server.\n2. Backup and remove the following files:\n\n<RHQ_SERVER_HOME>/jbossas/modules/system/layers/base/org/apache/commons/collections/main/commons-collections-3.2.1.redhat-3.jar    <RHQ_SERVER_HOME>/jbossas/modules/system/layers/base/org/apache/commons/collections/main/module.xml\n<RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-portal.war/WEB-INF/lib/commons-collections-3.2.1.jar\n<RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-content_http.war/WEB-INF/lib/commons-collections-3.2.1.jar\n<RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/lib/commons-collections-3.2.1.jar\n\n3. Extract the patch archive to the JBoss ON server's home directory.\n\nFor example:\nunzip -od \"${RHQ_SERVER_HOME}\" /tmp/BZ1281514.zip\n\nBe sure to replace any existing files if prompted.\n\n4. Start the JBoss ON server.\nRepeat the steps for any remaining JBoss ON servers in a HA environment.\n\nTo uninstall the patch:\n\n1. Stop the JBoss ON server.\n2. Remove the updated files:\n\n<RHQ_SERVER_HOME>/jbossas/modules/system/layers/base/org/apache/commons/collections/main/commons-collections-3.2.1.redhat-3-bz-1281962.jar         <RHQ_SERVER_HOME>/jbossas/modules/system/layers/base/org/apache/commons/collections/main/module.xml\n<RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-portal.war/WEB-INF/lib/commons-collections-3.2.1.redhat-3-bz-1281962.jar\n<RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-content_http.war/WEB-INF/lib/commons-collections-3.2.1.redhat-3-bz-1281962.jar\n<RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/lib/commons-collections-3.2.1.redhat-3-bz-1281962.jar\n\n3. Restore the following files from the backup created prior to applying this patch:\n\n<RHQ_SERVER_HOME>/jbossas/modules/system/layers/base/org/apache/commons/collections/main/commons-collections-3.2.1.redhat-3.jar            <RHQ_SERVER_HOME>/jbossas/modules/system/layers/base/org/apache/commons/collections/main/module.xml\n<RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-portal.war/WEB-INF/lib/commons-collections-3.2.1.jar\n<RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-content_http.war/WEB-INF/lib/commons-collections-3.2.1.jar\n<RHQ_SERVER_HOME>/modules/org/rhq/server-startup/main/deployments/rhq.ear/lib/commons-collections-3.2.1.jar\n\n4. Start the JBoss ON server.\n\nRepeat the steps for any remaining JBoss ON servers in a HA.",
               product_ids: [
                  "Red Hat JBoss Operations Network 3.3",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:2524",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss Operations Network 3.3",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Critical",
            },
         ],
         title: "apache-commons-collections: InvokerTransformer code execution during deserialisation",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Critical",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Red Hat JBoss BRMS 6.2.0, which fixes three security issues, several\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Red Hat JBoss BRMS is a business rules management system for the\nmanagement, storage, creation, modification, and deployment of JBoss Rules.\n\nThis release of Red Hat JBoss BRMS 6.2.0 serves as a replacement for Red\nHat JBoss BRMS 6.1.2, and includes bug fixes and enhancements. Refer to the\nRed Hat JBoss BRMS 6.2.0 Release Notes for information on the most\nsignificant of these changes. The Release Notes are available at\nhttps://access.redhat.com/documentation/en/red-hat-jboss-brms/\n\nThe following security issues are also fixed with this release:\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nIt was found that batik was vulnerable to XML External Entity attacks when\nparsing SVG files. A remote attacker able to send malicious SVG content to\nthe affected server could use this flaw to read files accessible to the\nuser running the application server, and potentially perform other more\nadvanced XXE attacks. (CVE-2015-0250)\n\nIt was found that jsoup did not properly validate user-supplied HTML\ncontent; certain HTML snippets could get past the validator without being\ndetected as unsafe. A remote attacker could use a specially crafted HTML\nsnippet to execute arbitrary web script in the user's browser.\n(CVE-2015-6748)\n\nAll users of Red Hat JBoss BRMS 6.1.2 as provided from the Red Hat Customer\nPortal are advised to upgrade to Red Hat JBoss BRMS 6.2.0.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2015:2559",
            url: "https://access.redhat.com/errata/RHSA-2015:2559",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#critical",
            url: "https://access.redhat.com/security/updates/classification/#critical",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=distributions&version=6.2.0",
            url: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=distributions&version=6.2.0",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/documentation/en/red-hat-jboss-brms/",
            url: "https://access.redhat.com/documentation/en/red-hat-jboss-brms/",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/solutions/2045023",
            url: "https://access.redhat.com/solutions/2045023",
         },
         {
            category: "external",
            summary: "1203762",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1203762",
         },
         {
            category: "external",
            summary: "1258310",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1258310",
         },
         {
            category: "external",
            summary: "1279330",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2559.json",
         },
      ],
      title: "Red Hat Security Advisory: Red Hat JBoss BRMS 6.2.0 update",
      tracking: {
         current_release_date: "2024-12-15T18:42:30+00:00",
         generator: {
            date: "2024-12-15T18:42:30+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.3",
            },
         },
         id: "RHSA-2015:2559",
         initial_release_date: "2015-12-07T20:46:42+00:00",
         revision_history: [
            {
               date: "2015-12-07T20:46:42+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2019-02-20T12:35:49+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-12-15T18:42:30+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat JBoss BRMS 6.2",
                        product: {
                           name: "Red Hat JBoss BRMS 6.2",
                           product_id: "Red Hat JBoss BRMS 6.2",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:jboss_brms:6.2",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Decision Manager",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2015-0250",
         cwe: {
            id: "CWE-611",
            name: "Improper Restriction of XML External Entity Reference",
         },
         discovery_date: "2015-03-17T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1203762",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that batik was vulnerable to XML External Entity attacks when parsing SVG files. A remote attacker able to send malicious SVG content to the affected server could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "batik: XML External Entity (XXE) injection in SVG parsing",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2015-0250",
            },
            {
               category: "external",
               summary: "RHBZ#1203762",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1203762",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2015-0250",
               url: "https://www.cve.org/CVERecord?id=CVE-2015-0250",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2015-0250",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2015-0250",
            },
            {
               category: "external",
               summary: "http://xmlgraphics.apache.org/security.html",
               url: "http://xmlgraphics.apache.org/security.html",
            },
         ],
         release_date: "2012-07-25T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-12-07T20:46:42+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:2559",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 5.8,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "NONE",
                  vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "batik: XML External Entity (XXE) injection in SVG parsing",
      },
      {
         cve: "CVE-2015-6748",
         cwe: {
            id: "CWE-79",
            name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
         },
         discovery_date: "2015-08-27T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1258310",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that jsoup did not properly validate user-supplied HTML content; certain HTML snippets could get past the validator without being detected as unsafe. A remote attacker could use a specially crafted HTML snippet to execute arbitrary web script in the user's browser.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "jsoup: XSS vulnerability related to incomplete tags at EOF",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2015-6748",
            },
            {
               category: "external",
               summary: "RHBZ#1258310",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1258310",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2015-6748",
               url: "https://www.cve.org/CVERecord?id=CVE-2015-6748",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2015-6748",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2015-6748",
            },
         ],
         release_date: "2015-08-27T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-12-07T20:46:42+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:2559",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "MEDIUM",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  availabilityImpact: "NONE",
                  baseScore: 4.9,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:M/Au:S/C:P/I:P/A:N",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "jsoup: XSS vulnerability related to incomplete tags at EOF",
      },
      {
         cve: "CVE-2015-7501",
         cwe: {
            id: "CWE-284",
            name: "Improper Access Control",
         },
         discovery_date: "2015-11-06T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1279330",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "apache-commons-collections: InvokerTransformer code execution during deserialisation",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "Red Hat JBoss BRMS 6.2",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2015-7501",
            },
            {
               category: "external",
               summary: "RHBZ#1279330",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
            },
            {
               category: "external",
               summary: "RHSB-2045023",
               url: "https://access.redhat.com/solutions/2045023",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2015-7501",
               url: "https://www.cve.org/CVERecord?id=CVE-2015-7501",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
            },
            {
               category: "external",
               summary: "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
               url: "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
            },
         ],
         release_date: "2015-11-06T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-12-07T20:46:42+00:00",
               details: "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
               product_ids: [
                  "Red Hat JBoss BRMS 6.2",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:2559",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               products: [
                  "Red Hat JBoss BRMS 6.2",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Critical",
            },
         ],
         title: "apache-commons-collections: InvokerTransformer code execution during deserialisation",
      },
   ],
}

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Updated rh-java-common-apache-commons-collections packages which fix one\nsecurity issue are now available for Red Hat Software Collections 2.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "The Apache Commons Collections library provides new interfaces,\nimplementations, and utilities to extend the features of the Java\nCollections Framework.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nWith this update, deserialization of certain classes in the\ncommons-collections library is no longer allowed. Applications that require\nthose classes to be deserialized can use the system property\n\"org.apache.commons.collections.enableUnsafeSerialization\" to re-enable\ntheir deserialization.\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of rh-java-common-apache-commons-collections are advised to\nupgrade to these updated packages, which contain a backported patch to\ncorrect this issue. All running applications using the commons-collections\nlibrary must be restarted for the update to take effect.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2015:2523",
            url: "https://access.redhat.com/errata/RHSA-2015:2523",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#important",
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/solutions/2045023",
            url: "https://access.redhat.com/solutions/2045023",
         },
         {
            category: "external",
            summary: "1279330",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2523.json",
         },
      ],
      title: "Red Hat Security Advisory: rh-java-common-apache-commons-collections security update",
      tracking: {
         current_release_date: "2024-12-15T18:41:54+00:00",
         generator: {
            date: "2024-12-15T18:41:54+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.3",
            },
         },
         id: "RHSA-2015:2523",
         initial_release_date: "2015-11-30T08:19:52+00:00",
         revision_history: [
            {
               date: "2015-11-30T08:19:52+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2015-11-30T08:19:52+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-12-15T18:41:54+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                        product: {
                           name: "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                           product_id: "7Server-RHSCL-2.1",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:rhel_software_collections:2::el7",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                        product: {
                           name: "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                           product_id: "7Workstation-RHSCL-2.1",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:rhel_software_collections:2::el7",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
                        product: {
                           name: "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
                           product_id: "7Server-RHSCL-2.1-7.1.Z",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:rhel_software_collections:2::el7",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
                        product: {
                           name: "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
                           product_id: "6Server-RHSCL-2.1-6.6.Z",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:rhel_software_collections:2::el6",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                        product: {
                           name: "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                           product_id: "6Server-RHSCL-2.1",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:rhel_software_collections:2::el6",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                        product: {
                           name: "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                           product_id: "6Workstation-RHSCL-2.1",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:rhel_software_collections:2::el6",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
                        product: {
                           name: "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
                           product_id: "6Server-RHSCL-2.1-6.7.Z",
                           product_identification_helper: {
                              cpe: "cpe:/a:redhat:rhel_software_collections:2::el6",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Software Collections",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
                        product: {
                           name: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
                           product_id: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-java-common-apache-commons-collections-testframework-javadoc@3.2.1-21.13.el7?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
                        product: {
                           name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
                           product_id: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-java-common-apache-commons-collections@3.2.1-21.13.el7?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
                        product: {
                           name: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
                           product_id: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-java-common-apache-commons-collections-javadoc@3.2.1-21.13.el7?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
                        product: {
                           name: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
                           product_id: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-java-common-apache-commons-collections-testframework@3.2.1-21.13.el7?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
                        product: {
                           name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
                           product_id: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-java-common-apache-commons-collections@3.2.1-21.13.el6?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
                        product: {
                           name: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
                           product_id: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-java-common-apache-commons-collections-javadoc@3.2.1-21.13.el6?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
                        product: {
                           name: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
                           product_id: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-java-common-apache-commons-collections-testframework@3.2.1-21.13.el6?arch=noarch",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
                        product: {
                           name: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
                           product_id: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-java-common-apache-commons-collections-testframework-javadoc@3.2.1-21.13.el6?arch=noarch",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
                        product: {
                           name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
                           product_id: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-java-common-apache-commons-collections@3.2.1-21.13.el7?arch=src",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
                        product: {
                           name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
                           product_id: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/rh-java-common-apache-commons-collections@3.2.1-21.13.el6?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
               product_id: "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Server-RHSCL-2.1-6.6.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
               product_id: "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
            relates_to_product_reference: "6Server-RHSCL-2.1-6.6.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
               product_id: "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Server-RHSCL-2.1-6.6.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
               product_id: "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Server-RHSCL-2.1-6.6.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
               product_id: "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Server-RHSCL-2.1-6.6.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
               product_id: "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Server-RHSCL-2.1-6.7.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
               product_id: "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
            relates_to_product_reference: "6Server-RHSCL-2.1-6.7.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
               product_id: "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Server-RHSCL-2.1-6.7.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
               product_id: "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Server-RHSCL-2.1-6.7.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
               product_id: "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Server-RHSCL-2.1-6.7.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Server-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
            relates_to_product_reference: "6Server-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Server-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Server-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Server-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Workstation-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
            relates_to_product_reference: "6Workstation-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Workstation-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Workstation-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
            relates_to_product_reference: "6Workstation-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
               product_id: "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
            relates_to_product_reference: "7Server-RHSCL-2.1-7.1.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
               product_id: "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
            relates_to_product_reference: "7Server-RHSCL-2.1-7.1.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
               product_id: "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
            relates_to_product_reference: "7Server-RHSCL-2.1-7.1.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
               product_id: "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
            relates_to_product_reference: "7Server-RHSCL-2.1-7.1.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
               product_id: "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
            relates_to_product_reference: "7Server-RHSCL-2.1-7.1.Z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
               product_id: "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
            relates_to_product_reference: "7Server-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
               product_id: "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
            relates_to_product_reference: "7Server-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
               product_id: "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
            relates_to_product_reference: "7Server-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
               product_id: "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
            relates_to_product_reference: "7Server-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
               product_id: "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
            relates_to_product_reference: "7Server-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
               product_id: "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
            relates_to_product_reference: "7Workstation-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
               product_id: "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
            },
            product_reference: "rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
            relates_to_product_reference: "7Workstation-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
               product_id: "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
            relates_to_product_reference: "7Workstation-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
               product_id: "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
            relates_to_product_reference: "7Workstation-RHSCL-2.1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
               product_id: "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
            },
            product_reference: "rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
            relates_to_product_reference: "7Workstation-RHSCL-2.1",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2015-7501",
         cwe: {
            id: "CWE-284",
            name: "Improper Access Control",
         },
         discovery_date: "2015-11-06T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1279330",
            },
         ],
         notes: [
            {
               category: "description",
               text: "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "apache-commons-collections: InvokerTransformer code execution during deserialisation",
               title: "Vulnerability summary",
            },
            {
               category: "other",
               text: "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
               title: "Statement",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
               "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
               "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
               "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
               "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
               "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
               "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
               "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
               "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
               "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
               "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
               "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
               "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
               "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
               "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
               "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
               "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
               "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
               "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
               "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
               "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
               "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
               "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
               "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
               "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
               "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
               "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
               "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
               "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
               "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
               "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
               "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
               "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
               "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
               "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2015-7501",
            },
            {
               category: "external",
               summary: "RHBZ#1279330",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
            },
            {
               category: "external",
               summary: "RHSB-2045023",
               url: "https://access.redhat.com/solutions/2045023",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2015-7501",
               url: "https://www.cve.org/CVERecord?id=CVE-2015-7501",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
            },
            {
               category: "external",
               summary: "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
               url: "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
            },
         ],
         release_date: "2015-11-06T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2015-11-30T08:19:52+00:00",
               details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
               product_ids: [
                  "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
                  "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
                  "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
                  "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
                  "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
                  "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
                  "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
                  "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
                  "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
                  "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
                  "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
                  "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
                  "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
                  "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
                  "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2015:2523",
            },
         ],
         scores: [
            {
               cvss_v2: {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  integrityImpact: "PARTIAL",
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
                  "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.6.Z:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
                  "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1-6.7.Z:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
                  "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
                  "6Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.noarch",
                  "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el6.src",
                  "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el6.noarch",
                  "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el6.noarch",
                  "6Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el6.noarch",
                  "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
                  "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1-7.1.Z:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
                  "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
                  "7Server-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
                  "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.noarch",
                  "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-0:3.2.1-21.13.el7.src",
                  "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-javadoc-0:3.2.1-21.13.el7.noarch",
                  "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-0:3.2.1-21.13.el7.noarch",
                  "7Workstation-RHSCL-2.1:rh-java-common-apache-commons-collections-testframework-javadoc-0:3.2.1-21.13.el7.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "apache-commons-collections: InvokerTransformer code execution during deserialisation",
      },
   ],
}