{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat JBoss Operations Network 3.2.3 that fixes one\nsecurity issue in the Apache commons-collections library is now available. \n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "JBoss Operations Network provides an integrated solution for managing\nJBoss middleware, other network infrastructure, and applications built\non Red Hat Enterprise Application Platform (EAP). The Apache Commons\nCollections library provides new interfaces, implementations, and\nutilities to extend the features of the Java Collections Framework.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of JBoss Operations Network 3.2.3 as provided from the Red Hat\nCustomer Portal are advised to apply this security update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2547",
        "url": "https://access.redhat.com/errata/RHSA-2015:2547"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=em\u0026version=3.2.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=em\u0026version=3.2.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2547.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Operations Network 3.2.3 security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:18:32+00:00",
      "generator": {
        "date": "2026-05-14T22:18:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2015:2547",
      "initial_release_date": "2015-12-04T17:12:47+00:00",
      "revision_history": [
        {
          "date": "2015-12-04T17:12:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:37:29+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:18:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Operations Network 3.2",
                "product": {
                  "name": "Red Hat JBoss Operations Network 3.2",
                  "product_id": "Red Hat JBoss Operations Network 3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_operations_network:3.2.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Operations Network"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Operations Network 3.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-04T17:12:47+00:00",
          "details": "This is a server patch that contains a single fix and should not be mixed\nwith other server patches. If you already have a server patch, please\ncontact Red Hat Global Support Services for compatibility assessment.\n\nYou must shutdown the JBoss ON server prior to applying this patch.\n\nThis patch must be applied to each JBoss ON server in a high-availability\n(HA) environment. You can apply the patch to each server individually so\nthat only one server is down at a time.\n\nTo install the patch:\n    1.  Stop the JBoss ON server.\n    2.  Backup and remove the following files:\n\n            \u003cRHQ_SERVER_HOME\u003e/jbossas/modules/system/layers/base/org/apache/commons/collections/main/commons-collections-3.2.1-redhat-2.jar\n            \u003cRHQ_SERVER_HOME\u003e/jbossas/modules/system/layers/base/org/apache/commons/collections/main/module.xml\n            \u003cRHQ_SERVER_HOME\u003e/modules/org/rhq/server-startup/main/deployments/rhq.ear/lib/commons-collections-3.2.1.jar\n            \u003cRHQ_SERVER_HOME\u003e/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-portal.war/WEB-INF/lib/commons-collections-3.2.1.jar\n            \u003cRHQ_SERVER_HOME\u003e/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-content_http.war/WEB-INF/lib/commons-collections-3.2.1.jar\n\n    3.  Extract the patch archive to the JBoss ON server\u0027s home directory.\n\n        For example:\n            unzip -od \"${RHQ_SERVER_HOME}\" /tmp/BZ1282545.zip\n\n        Be sure to replace any existing files if prompted.\n    4.  Start the JBoss ON server.\n\n    Repeat the steps for any remaining JBoss ON servers in a HA environment.\n\n    To uninstall the patch:\n    1.  Stop the JBoss ON server.\n    2.  Remove the updated files:\n\n            \u003cRHQ_SERVER_HOME\u003e/jbossas/modules/system/layers/base/org/apache/commons/collections/main/commons-collections-3.2.1.redhat-3-bz-1281964.jar\n            \u003cRHQ_SERVER_HOME\u003e/jbossas/modules/system/layers/base/org/apache/commons/collections/main/module.xml\n            \u003cRHQ_SERVER_HOME\u003e/modules/org/rhq/server-startup/main/deployments/rhq.ear/lib/commons-collections-3.2.1.redhat-3-bz-1281964.jar\n            \u003cRHQ_SERVER_HOME\u003e/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-portal.war/WEB-INF/lib/commons-collections-3.2.1.redhat-3-bz-1281964.jar\n            \u003cRHQ_SERVER_HOME\u003e/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-content_http.war/WEB-INF/lib/commons-collections-3.2.1.redhat-3-bz-1281964.jar\n\n    3.  Restore the following files from the backup created prior to applying this patch:\n\n            \u003cRHQ_SERVER_HOME\u003e/jbossas/modules/system/layers/base/org/apache/commons/collections/main/commons-collections-3.2.1-redhat-2.jar\n            \u003cRHQ_SERVER_HOME\u003e/jbossas/modules/system/layers/base/org/apache/commons/collections/main/module.xml\n            \u003cRHQ_SERVER_HOME\u003e/modules/org/rhq/server-startup/main/deployments/rhq.ear/lib/commons-collections-3.2.1.jar\n            \u003cRHQ_SERVER_HOME\u003e/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-portal.war/WEB-INF/lib/commons-collections-3.2.1.jar\n            \u003cRHQ_SERVER_HOME\u003e/modules/org/rhq/server-startup/main/deployments/rhq.ear/rhq-content_http.war/WEB-INF/lib/commons-collections-3.2.1.jar\n\n    4.  Start the JBoss ON server.\n\n    Repeat the steps for any remaining JBoss ON servers in a HA environment.",
          "product_ids": [
            "Red Hat JBoss Operations Network 3.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2547"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Operations Network 3.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat JBoss Web Server 3.0.1 that fixes one security issue\nin the Apache commons-collections library is now available.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Web Server is a fully integrated and certified set of\ncomponents for hosting Java web applications. The Apache Commons\nCollections library provides new interfaces, implementations, and\nutilities to extend the features of the Java Collections Framework.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about the commons-collections flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of Red Hat JBoss Web Server 3.0.1 are advised to apply this\nupdate. The Red Hat JBoss Web Server process must be restarted for the\nupdate to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2548",
        "url": "https://access.redhat.com/errata/RHSA-2015:2548"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=webserver\u0026version=3.0.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=webserver\u0026version=3.0.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2548.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Web Server 3.0.1 commons-collections security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:18:32+00:00",
      "generator": {
        "date": "2026-05-14T22:18:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2015:2548",
      "initial_release_date": "2015-12-04T17:12:42+00:00",
      "revision_history": [
        {
          "date": "2015-12-04T17:12:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2015-12-04T17:12:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:18:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Web Server 3.0",
                "product": {
                  "name": "Red Hat JBoss Web Server 3.0",
                  "product_id": "Red Hat JBoss Web Server 3.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Web Server"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Web Server 3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-04T17:12:42+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied, and back up your existing Red\nHat JBoss Web Server installation (including all applications and\nconfiguration files).\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Web Server 3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2548"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Web Server 3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss Fuse 6.2.1, which fixes three security issues, several bugs,\nand adds various enhancements, is now available from the Red Hat Customer\nPortal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint,\nflexible, open source enterprise service bus and integration platform.\n\nRed Hat JBoss Fuse 6.2.1 is a micro product release that updates Red Hat\nJBoss Fuse 6.2.0, and includes several bug fixes and enhancements. Refer to\nthe Release Notes document, available from the link in the References\nsection, for a list of changes.\n\nThe following security fixes are addressed in this release:\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this issue may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nA flaw was discovered that when an application uses Groovy (has it on the\nclasspath) and uses the standard Java serialization mechanism, an attacker\ncan bake a special serialized object that executes code directly when\ndeserialized. All applications which rely on serialization and do not\nisolate the code which deserializes objects are subject to this\nvulnerability. (CVE-2015-3253)\n\nIt was found that the JBoss A-MQ console would accept a string containing\nJavaScript as the name of a new message queue. Execution of the UI would\nsubsequently execute the script. An attacker could use this flaw to access\nsensitive information or perform other attacks. (CVE-2015-5181)\n\nRed Hat would like to thank Naftali Rosenbaum of Comsec Consulting for\nreporting CVE-2015-5181.\n\nAll users of Red Hat JBoss Fuse 6.2.0 are advised to apply this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2556",
        "url": "https://access.redhat.com/errata/RHSA-2015:2556"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=distributions\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=distributions\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_Fuse/",
        "url": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_Fuse/"
      },
      {
        "category": "external",
        "summary": "1243934",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
      },
      {
        "category": "external",
        "summary": "1248804",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1248804"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "external",
        "summary": "ENTESB-4398",
        "url": "https://issues.redhat.com/browse/ENTESB-4398"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2556.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Fuse 6.2.1 update",
    "tracking": {
      "current_release_date": "2026-05-14T22:18:32+00:00",
      "generator": {
        "date": "2026-05-14T22:18:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2015:2556",
      "initial_release_date": "2015-12-07T20:46:59+00:00",
      "revision_history": [
        {
          "date": "2015-12-07T20:46:59+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:36:05+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:18:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Fuse 6.2",
                "product": {
                  "name": "Red Hat JBoss Fuse 6.2",
                  "product_id": "Red Hat JBoss Fuse 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_fuse:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Fuse"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-3253",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-07-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1243934"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "groovy: remote execution of untrusted code in class MethodClosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "RHBZ#1243934",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/oss-sec/2015/q3/121",
          "url": "http://seclists.org/oss-sec/2015/q3/121"
        }
      ],
      "release_date": "2015-07-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:59+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2556"
        },
        {
          "category": "workaround",
          "details": "Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):\n\n    public class MethodClosure extends Closure {\n        +    private Object readResolve() {\n        +        throw new UnsupportedOperationException();\n        +    \n        }\n\nAlternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.",
          "product_ids": [
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "groovy: remote execution of untrusted code in class MethodClosure"
    },
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Fuse 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:59+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss Fuse 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2556"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss Fuse 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss A-MQ 6.2.1, which fixes three security issues, several bugs,\nand adds various enhancements, is now available from the Red Hat Customer\nPortal.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards-compliant\nmessaging system that is tailored for use in mission critical applications.\n\nRed Hat JBoss A-MQ 6.2.1 is a micro product release that updates Red Hat\nJBoss A-MQ 6.2.0, and includes several bug fixes and enhancements. Refer to\nthe Release Notes document, available from the link in the References\nsection, for a list of changes.\n\nThe following security fixes are addressed in this release:\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this issue may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nA flaw was discovered that when an application uses Groovy (has it on the\nclasspath) and uses the standard Java serialization mechanism, an attacker\ncan bake a special serialized object that executes code directly when\ndeserialized. All applications which rely on serialization and do not\nisolate the code which deserializes objects are subject to this\nvulnerability. (CVE-2015-3253)\n\nIt was found that the JBoss A-MQ console would accept a string containing\nJavaScript as the name of a new message queue. Execution of the UI would\nsubsequently execute the script. An attacker could use this flaw to access\nsensitive information or perform other attacks. (CVE-2015-5181)\n\nRed Hat would like to thank Naftali Rosenbaum of Comsec Consulting for\nreporting CVE-2015-5181.\n\nAll users of Red Hat JBoss A-MQ 6.2.0 as provided from the Red Hat Customer\nPortal are advised to apply this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2557",
        "url": "https://access.redhat.com/errata/RHSA-2015:2557"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=distributions\u0026version=6.2.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.amq\u0026downloadType=distributions\u0026version=6.2.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_A-MQ/",
        "url": "https://access.redhat.com/site/documentation/en-US/Red_Hat_JBoss_A-MQ/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1243934",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
      },
      {
        "category": "external",
        "summary": "1248804",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1248804"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "external",
        "summary": "ENTESB-4398",
        "url": "https://issues.redhat.com/browse/ENTESB-4398"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2557.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss A-MQ 6.2.1 update",
    "tracking": {
      "current_release_date": "2026-05-14T22:18:33+00:00",
      "generator": {
        "date": "2026-05-14T22:18:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2015:2557",
      "initial_release_date": "2015-12-07T20:46:54+00:00",
      "revision_history": [
        {
          "date": "2015-12-07T20:46:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:36:21+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:18:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss A-MQ 6.2",
                "product": {
                  "name": "Red Hat JBoss A-MQ 6.2",
                  "product_id": "Red Hat JBoss A-MQ 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_amq:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss AMQ"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-3253",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-07-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1243934"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in the way applications using Groovy used the standard Java serialization mechanism. A remote attacker could use a specially crafted serialized object that would execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "groovy: remote execution of untrusted code in class MethodClosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "RHBZ#1243934",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1243934"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-3253",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3253"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/oss-sec/2015/q3/121",
          "url": "http://seclists.org/oss-sec/2015/q3/121"
        }
      ],
      "release_date": "2015-07-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:54+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2557"
        },
        {
          "category": "workaround",
          "details": "Apply the following patch on the MethodClosure class (src/main/org/codehaus/groovy/runtime/MethodClosure.java):\n\n    public class MethodClosure extends Closure {\n        +    private Object readResolve() {\n        +        throw new UnsupportedOperationException();\n        +    \n        }\n\nAlternatively, you should make sure to use a custom security policy file (using the standard Java security manager) or make sure that you do not rely on serialization to communicate remotely.",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "groovy: remote execution of untrusted code in class MethodClosure"
    },
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss A-MQ 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:54+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
          "product_ids": [
            "Red Hat JBoss A-MQ 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2557"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss A-MQ 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss BRMS 6.2.0, which fixes three security issues, several\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss BRMS is a business rules management system for the\nmanagement, storage, creation, modification, and deployment of JBoss Rules.\n\nThis release of Red Hat JBoss BRMS 6.2.0 serves as a replacement for Red\nHat JBoss BRMS 6.1.2, and includes bug fixes and enhancements. Refer to the\nRed Hat JBoss BRMS 6.2.0 Release Notes for information on the most\nsignificant of these changes. The Release Notes are available at\nhttps://access.redhat.com/documentation/en/red-hat-jboss-brms/\n\nThe following security issues are also fixed with this release:\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nIt was found that batik was vulnerable to XML External Entity attacks when\nparsing SVG files. A remote attacker able to send malicious SVG content to\nthe affected server could use this flaw to read files accessible to the\nuser running the application server, and potentially perform other more\nadvanced XXE attacks. (CVE-2015-0250)\n\nIt was found that jsoup did not properly validate user-supplied HTML\ncontent; certain HTML snippets could get past the validator without being\ndetected as unsafe. A remote attacker could use a specially crafted HTML\nsnippet to execute arbitrary web script in the user\u0027s browser.\n(CVE-2015-6748)\n\nAll users of Red Hat JBoss BRMS 6.1.2 as provided from the Red Hat Customer\nPortal are advised to upgrade to Red Hat JBoss BRMS 6.2.0.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2559",
        "url": "https://access.redhat.com/errata/RHSA-2015:2559"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.2.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=distributions\u0026version=6.2.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/red-hat-jboss-brms/",
        "url": "https://access.redhat.com/documentation/en/red-hat-jboss-brms/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1203762",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203762"
      },
      {
        "category": "external",
        "summary": "1258310",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1258310"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2559.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss BRMS 6.2.0 update",
    "tracking": {
      "current_release_date": "2026-05-14T22:18:33+00:00",
      "generator": {
        "date": "2026-05-14T22:18:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2015:2559",
      "initial_release_date": "2015-12-07T20:46:42+00:00",
      "revision_history": [
        {
          "date": "2015-12-07T20:46:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:35:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:18:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss BRMS 6.2",
                "product": {
                  "name": "Red Hat JBoss BRMS 6.2",
                  "product_id": "Red Hat JBoss BRMS 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_brms:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Decision Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-0250",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2015-03-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1203762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that batik was vulnerable to XML External Entity attacks when parsing SVG files. A remote attacker able to send malicious SVG content to the affected server could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "batik: XML External Entity (XXE) injection in SVG parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BRMS 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-0250"
        },
        {
          "category": "external",
          "summary": "RHBZ#1203762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-0250",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-0250"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0250",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0250"
        },
        {
          "category": "external",
          "summary": "http://xmlgraphics.apache.org/security.html",
          "url": "http://xmlgraphics.apache.org/security.html"
        }
      ],
      "release_date": "2012-07-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:42+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BRMS 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2559"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BRMS 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "batik: XML External Entity (XXE) injection in SVG parsing"
    },
    {
      "cve": "CVE-2015-6748",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2015-08-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1258310"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that jsoup did not properly validate user-supplied HTML content; certain HTML snippets could get past the validator without being detected as unsafe. A remote attacker could use a specially crafted HTML snippet to execute arbitrary web script in the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jsoup: XSS vulnerability related to incomplete tags at EOF",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BRMS 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-6748"
        },
        {
          "category": "external",
          "summary": "RHBZ#1258310",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1258310"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-6748",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-6748"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-6748",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6748"
        }
      ],
      "release_date": "2015-08-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:42+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BRMS 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2559"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BRMS 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jsoup: XSS vulnerability related to incomplete tags at EOF"
    },
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BRMS 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:42+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing the\nupdate, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BRMS 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2559"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BRMS 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat JBoss BPM Suite 6.2.0, which fixes three security issues, several\nbugs, and adds various enhancements, is now available from the Red Hat\nCustomer Portal.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss BPM Suite is a business rules and processes management system\nfor the management, storage, creation, modification, and deployment of\nJBoss rules and BPMN2-compliant business processes.\n\nThis release of Red Hat JBoss BPM Suite 6.2.0 serves as a replacement for\nRed Hat JBoss BPM Suite 6.1.2, and includes bug fixes and enhancements.\nRefer to the Red Hat JBoss BPM Suite 6.2.0 Release Notes for information on\nthe most significant of these changes. The Release Notes are available at\nhttps://access.redhat.com/documentation/en/red-hat-jboss-brms/\n\nThe following security issues are also fixed with this release:\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nIt was found that batik was vulnerable to XML External Entity attacks when\nparsing SVG files. A remote attacker able to send malicious SVG content to\nthe affected server could use this flaw to read files accessible to the\nuser running the application server, and potentially perform other more\nadvanced XXE attacks. (CVE-2015-0250)\n\nIt was found that jsoup did not properly validate user-supplied HTML\ncontent; certain HTML snippets could get past the validator without being\ndetected as unsafe. A remote attacker could use a specially crafted HTML\nsnippet to execute arbitrary web script in the user\u0027s browser.\n(CVE-2015-6748)\n\nAll users of Red Hat JBoss BPM Suite 6.1.2 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Red Hat JBoss BPM Suite 6.2.0.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2560",
        "url": "https://access.redhat.com/errata/RHSA-2015:2560"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.2.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=distributions\u0026version=6.2.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/red-hat-jboss-bpm-suite/",
        "url": "https://access.redhat.com/documentation/en/red-hat-jboss-bpm-suite/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1203762",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203762"
      },
      {
        "category": "external",
        "summary": "1258310",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1258310"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2560.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.2.0 update",
    "tracking": {
      "current_release_date": "2026-05-14T22:18:34+00:00",
      "generator": {
        "date": "2026-05-14T22:18:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2015:2560",
      "initial_release_date": "2015-12-07T20:46:36+00:00",
      "revision_history": [
        {
          "date": "2015-12-07T20:46:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:36:08+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:18:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss BPMS 6.2",
                "product": {
                  "name": "Red Hat JBoss BPMS 6.2",
                  "product_id": "Red Hat JBoss BPMS 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_bpms:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Process Automation Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-0250",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2015-03-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1203762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that batik was vulnerable to XML External Entity attacks when parsing SVG files. A remote attacker able to send malicious SVG content to the affected server could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "batik: XML External Entity (XXE) injection in SVG parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BPMS 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-0250"
        },
        {
          "category": "external",
          "summary": "RHBZ#1203762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1203762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-0250",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-0250"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-0250",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-0250"
        },
        {
          "category": "external",
          "summary": "http://xmlgraphics.apache.org/security.html",
          "url": "http://xmlgraphics.apache.org/security.html"
        }
      ],
      "release_date": "2012-07-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:36+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BPMS 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2560"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BPMS 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "batik: XML External Entity (XXE) injection in SVG parsing"
    },
    {
      "cve": "CVE-2015-6748",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2015-08-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1258310"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that jsoup did not properly validate user-supplied HTML content; certain HTML snippets could get past the validator without being detected as unsafe. A remote attacker could use a specially crafted HTML snippet to execute arbitrary web script in the user\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jsoup: XSS vulnerability related to incomplete tags at EOF",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BPMS 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-6748"
        },
        {
          "category": "external",
          "summary": "RHBZ#1258310",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1258310"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-6748",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-6748"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-6748",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-6748"
        }
      ],
      "release_date": "2015-08-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:36+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BPMS 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2560"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BPMS 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jsoup: XSS vulnerability related to incomplete tags at EOF"
    },
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BPMS 6.2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-07T20:46:36+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BPMS 6.2"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2560"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BPMS 6.2"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache Commons Collections component that fixes one\nsecurity issue is now available from the Red Hat Customer Portal for Red\nHat JBoss BRMS 6.1.0.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Commons Collections is a library built upon Java JDK classes by\nproviding new interfaces, implementations and utilities.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of Red Hat JBoss BRMS 6.1.0 as provided from the Red\nHat Customer Portal are advised to apply this security update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2578",
        "url": "https://access.redhat.com/errata/RHSA-2015:2578"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=securityPatches\u0026version=6.1.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=securityPatches\u0026version=6.1.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2578.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss BRMS 6.1.0 commons-collections security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:18:34+00:00",
      "generator": {
        "date": "2026-05-14T22:18:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2015:2578",
      "initial_release_date": "2015-12-08T16:18:42+00:00",
      "revision_history": [
        {
          "date": "2015-12-08T16:18:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:38:08+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:18:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss BRMS 6.1",
                "product": {
                  "name": "Red Hat JBoss BRMS 6.1",
                  "product_id": "Red Hat JBoss BRMS 6.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_brms:6.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Decision Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BRMS 6.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-08T16:18:42+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss BRMS installation (including its databases,\napplications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss BRMS server by\nstopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the Red Hat JBoss\nBRMS server by starting the JBoss Application Server process.",
          "product_ids": [
            "Red Hat JBoss BRMS 6.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2578"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BRMS 6.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache Commons Collections component that fixes one\nsecurity issue is now available from the Red Hat Customer Portal for Red\nHat JBoss BPM Suite 6.1.0.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Commons Collections is a library built upon Java JDK classes by\nproviding new interfaces, implementations and utilities.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of Red Hat JBoss BPM Suite 6.1.0 as provided from the Red Hat\nCustomer Portal are advised to apply this security update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2579",
        "url": "https://access.redhat.com/errata/RHSA-2015:2579"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=securityPatches\u0026version=6.1.0",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=bpm.suite\u0026downloadType=securityPatches\u0026version=6.1.0"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2579.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.1.0 commons-collections security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:18:34+00:00",
      "generator": {
        "date": "2026-05-14T22:18:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2015:2579",
      "initial_release_date": "2015-12-08T16:18:35+00:00",
      "revision_history": [
        {
          "date": "2015-12-08T16:18:35+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:36:09+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:18:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss BPMS 6.0",
                "product": {
                  "name": "Red Hat JBoss BPMS 6.0",
                  "product_id": "Red Hat JBoss BPMS 6.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_bpms:6.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Process Automation Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss BPMS 6.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-08T16:18:35+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the updates). Before applying the updates, back up your\nexisting installation, including all applications, configuration files,\ndatabases and database settings, and so on.\n\nIt is recommended to halt the server by stopping the JBoss Application\nServer process before installing this update, and then after installing\nthe update, restart the server by starting the JBoss Application Server\nprocess.",
          "product_ids": [
            "Red Hat JBoss BPMS 6.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2579"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "Red Hat JBoss BPMS 6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for the Apache Commons Collections component that fixes one\nsecurity issue is now available from the Red Hat Customer Portal for Red\nHat JBoss BRMS 5.3.1.\n\nRed Hat Product Security has rated this update as having Critical security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Apache Commons Collections is a library built upon Java JDK classes by\nproviding new interfaces, implementations and utilities.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of Red Hat JBoss BRMS 5.3.1 as provided from the Red Hat Customer\nPortal are advised to apply this security update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2670",
        "url": "https://access.redhat.com/errata/RHSA-2015:2670"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=securityPatches\u0026version=5.3.1",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms\u0026downloadType=securityPatches\u0026version=5.3.1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2670.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss BRMS 5.3.1 commons-collections security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:18:34+00:00",
      "generator": {
        "date": "2026-05-14T22:18:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2015:2670",
      "initial_release_date": "2015-12-18T21:17:13+00:00",
      "revision_history": [
        {
          "date": "2015-12-18T21:17:13+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-02-20T12:37:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:18:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "JBoss Enterprise BRMS Platform 5.3",
                "product": {
                  "name": "JBoss Enterprise BRMS Platform 5.3",
                  "product_id": "JBoss Enterprise BRMS Platform 5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_brms_platform:5.3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Decision Manager"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "JBoss Enterprise BRMS Platform 5.3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-18T21:17:13+00:00",
          "details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss BRMS installation (including its databases,\napplications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss BRMS server by\nstopping the JBoss Application Server process before installing this\nupdate, and then after installing the update, restart the Red Hat JBoss\nBRMS server by starting the JBoss Application Server process.",
          "product_ids": [
            "JBoss Enterprise BRMS Platform 5.3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2670"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "JBoss Enterprise BRMS Platform 5.3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated jakarta-commons-collections packages that fix one security issue\nare now available for Red Hat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available from the CVE link in the\nReferences section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Jakarta/Apache Commons Collections library provides new interfaces,\nimplementations, and utilities to extend the features of the Java\nCollections Framework.\n\nIt was found that the Apache commons-collections library permitted code\nexecution when deserializing objects involving a specially constructed\nchain of classes. A remote attacker could use this flaw to execute\narbitrary code with the permissions of the application using the\ncommons-collections library. (CVE-2015-7501)\n\nWith this update, deserialization of certain classes in the\ncommons-collections library is no longer allowed. Applications that require\nthose classes to be deserialized can use the system property\n\"org.apache.commons.collections.enableUnsafeSerialization\" to re-enable\ntheir deserialization.\n\nFurther information about this security flaw may be found at:\nhttps://access.redhat.com/solutions/2045023\n\nAll users of jakarta-commons-collections are advised to upgrade to these\nupdated packages, which contain a backported patch to correct this issue.\nAll running applications using the commons-collections library must be\nrestarted for the update to take effect.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2015:2671",
        "url": "https://access.redhat.com/errata/RHSA-2015:2671"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/solutions/2045023",
        "url": "https://access.redhat.com/solutions/2045023"
      },
      {
        "category": "external",
        "summary": "1279330",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2671.json"
      }
    ],
    "title": "Red Hat Security Advisory: jakarta-commons-collections security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:18:34+00:00",
      "generator": {
        "date": "2026-05-14T22:18:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2015:2671",
      "initial_release_date": "2015-12-21T06:05:27+00:00",
      "revision_history": [
        {
          "date": "2015-12-21T06:05:27+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2015-12-21T06:05:28+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:18:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop (v. 5 client)",
                  "product_id": "5Client-5.11.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::client"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
                "product": {
                  "name": "Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
                  "product_id": "5Client-Workstation-5.11.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::client_workstation"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux (v. 5 server)",
                "product": {
                  "name": "Red Hat Enterprise Linux (v. 5 server)",
                  "product_id": "5Server-5.11.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:5::server"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
                "product": {
                  "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
                  "product_id": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework-javadoc@3.2-2jpp.4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-0:3.2-2jpp.4.i386",
                "product": {
                  "name": "jakarta-commons-collections-0:3.2-2jpp.4.i386",
                  "product_id": "jakarta-commons-collections-0:3.2-2jpp.4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections@3.2-2jpp.4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
                "product": {
                  "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
                  "product_id": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework@3.2-2jpp.4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
                "product": {
                  "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
                  "product_id": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-debuginfo@3.2-2jpp.4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
                "product": {
                  "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
                  "product_id": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-javadoc@3.2-2jpp.4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
                "product": {
                  "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
                  "product_id": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-tomcat5@3.2-2jpp.4?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
                "product": {
                  "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
                  "product_id": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework@3.2-2jpp.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
                "product": {
                  "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
                  "product_id": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-debuginfo@3.2-2jpp.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
                "product": {
                  "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
                  "product_id": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework-javadoc@3.2-2jpp.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
                "product": {
                  "name": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
                  "product_id": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections@3.2-2jpp.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
                "product": {
                  "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
                  "product_id": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-javadoc@3.2-2jpp.4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
                "product": {
                  "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
                  "product_id": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-tomcat5@3.2-2jpp.4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-0:3.2-2jpp.4.src",
                "product": {
                  "name": "jakarta-commons-collections-0:3.2-2jpp.4.src",
                  "product_id": "jakarta-commons-collections-0:3.2-2jpp.4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections@3.2-2jpp.4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
                "product": {
                  "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
                  "product_id": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework-javadoc@3.2-2jpp.4?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
                "product": {
                  "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
                  "product_id": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-tomcat5@3.2-2jpp.4?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
                "product": {
                  "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
                  "product_id": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-debuginfo@3.2-2jpp.4?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-0:3.2-2jpp.4.ia64",
                "product": {
                  "name": "jakarta-commons-collections-0:3.2-2jpp.4.ia64",
                  "product_id": "jakarta-commons-collections-0:3.2-2jpp.4.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections@3.2-2jpp.4?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
                "product": {
                  "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
                  "product_id": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework@3.2-2jpp.4?arch=ia64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
                "product": {
                  "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
                  "product_id": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-javadoc@3.2-2jpp.4?arch=ia64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ia64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
                "product": {
                  "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
                  "product_id": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework-javadoc@3.2-2jpp.4?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
                "product": {
                  "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
                  "product_id": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-debuginfo@3.2-2jpp.4?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
                "product": {
                  "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
                  "product_id": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-javadoc@3.2-2jpp.4?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-0:3.2-2jpp.4.ppc",
                "product": {
                  "name": "jakarta-commons-collections-0:3.2-2jpp.4.ppc",
                  "product_id": "jakarta-commons-collections-0:3.2-2jpp.4.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections@3.2-2jpp.4?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
                "product": {
                  "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
                  "product_id": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-tomcat5@3.2-2jpp.4?arch=ppc"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
                "product": {
                  "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
                  "product_id": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework@3.2-2jpp.4?arch=ppc"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
                "product": {
                  "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
                  "product_id": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-tomcat5@3.2-2jpp.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
                "product": {
                  "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
                  "product_id": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework-javadoc@3.2-2jpp.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-0:3.2-2jpp.4.s390x",
                "product": {
                  "name": "jakarta-commons-collections-0:3.2-2jpp.4.s390x",
                  "product_id": "jakarta-commons-collections-0:3.2-2jpp.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections@3.2-2jpp.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
                "product": {
                  "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
                  "product_id": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-javadoc@3.2-2jpp.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
                "product": {
                  "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
                  "product_id": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-debuginfo@3.2-2jpp.4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
                "product": {
                  "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
                  "product_id": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jakarta-commons-collections-testframework@3.2-2jpp.4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.src as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.src",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 5 client)",
          "product_id": "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.src as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.src",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux Desktop Workstation (v. 5 client)",
          "product_id": "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Client-Workstation-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.src as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.src",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
        "relates_to_product_reference": "5Server-5.11.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64 as a component of Red Hat Enterprise Linux (v. 5 server)",
          "product_id": "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64"
        },
        "product_reference": "jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
        "relates_to_product_reference": "5Server-5.11.Z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2015-7501",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2015-11-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1279330"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "apache-commons-collections: InvokerTransformer code execution during deserialisation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the Apache commons-collections library as shipped with Fuse 6.2.0 and A-MQ 6.2.0. However, this flaw is not known to be exploitable under supported scenarios in these product versions, and so has been assigned an impact of Important for these products and their respective errata.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
          "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
          "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
          "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
          "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
          "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
          "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
          "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
          "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
          "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
          "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
          "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
          "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
          "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
          "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
          "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
          "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
          "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
          "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
          "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
          "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
          "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
          "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
          "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
          "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
          "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
          "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
          "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
          "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
          "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
          "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
          "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
          "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
          "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
          "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
          "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
          "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
          "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
          "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
          "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
          "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
          "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
          "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
          "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
          "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "RHBZ#1279330",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1279330"
        },
        {
          "category": "external",
          "summary": "RHSB-2045023",
          "url": "https://access.redhat.com/solutions/2045023"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2015-7501",
          "url": "https://www.cve.org/CVERecord?id=CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7501"
        },
        {
          "category": "external",
          "summary": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/",
          "url": "http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"
        }
      ],
      "release_date": "2015-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2015-12-21T06:05:27+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2015:2671"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
            "5Client-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
            "5Client-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
            "5Client-Workstation-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.src",
            "5Server-5.11.Z:jakarta-commons-collections-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-debuginfo-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-javadoc-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-testframework-javadoc-0:3.2-2jpp.4.x86_64",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.i386",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ia64",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.ppc",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.s390x",
            "5Server-5.11.Z:jakarta-commons-collections-tomcat5-0:3.2-2jpp.4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation"
    }
  ]
}