[GHSA-fjq5-5j5f-mvxh] Deserialization of Untrusted Data in Apache commons collections

[joshbressers]

Updates

• Affected products

Comments
The versions listed had overlap and didn't seem to make sense based on the data in https://issues.apache.org/jira/browse/COLLECTIONS-580

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the OSV advisory for CVE-2015-7501 (Apache Commons Collections deserialization) by refining the affected-version ranges and adjusting the list of affected Maven artifacts.

Changes:

• Updated the advisory modified timestamp.
• Changed affected range start points for commons-collections and commons-collections4.
• Removed several additional affected Maven coordinates (ServiceMix bundles and collections-generic) from the advisory.

Comments suppressed due to low confidence (2)

advisories/github-reviewed/2022/05/GHSA-fjq5-5j5f-mvxh/GHSA-fjq5-5j5f-mvxh.json:32

• Changing "introduced" from "0" to "3.0" narrows the affected range and will exclude any vulnerable org.apache.commons:commons-collections versions prior to 3.0 (the Maven artifact has pre-3.0 releases). If the intent is “all versions before 3.2.2”, introduced should remain "0"; otherwise, please add evidence that < 3.0 is not affected (and encode that explicitly).

              "introduced": "3.0"
            },
            {
              "fixed": "3.2.2"
            }

advisories/github-reviewed/2022/05/GHSA-fjq5-5j5f-mvxh/GHSA-fjq5-5j5f-mvxh.json:1

• This hunk shows the affected array now ends after the two Apache coordinates; the PR also removed additional Maven coordinates (e.g., ServiceMix bundle coordinates and collections-generic). If those coordinates are still used by downstream consumers, removing them will prevent OSV-based tooling from flagging affected dependencies for those specific GAVs. If the intent is to de-scope them because they’re not actually affected, consider adding replacement affected entries with correct ranges (or otherwise retaining them) so scanners don’t lose coverage for commonly-used repackaged artifacts.

{

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.