VMSA-2015-0009.4 - for VDP 6.x as well?

I remember going through this advisory and patching my vRealize Orchestrator 6 machines earlier this year.  My security team just finished a scan of some new vSphere Data Protection 6.1.2 instances I stood up and said they also have the same vulnerability (rated "high", CVSS=10).  Unfortunately, the advisory doesn't list VDP.  I looked through all the other advisories for VDP for the past year or two, but don't see this one listed anywhere.  I found commons-collections-3.2.1.jar in several places on the VDP machines, but in one particular instance, it looks like an expanded .war file also contains the vulnerable .jar file as well (/usr/local/avamar/lib/jetty/avi.war).  I'm ok with swapping out the existing .jar's with commons-collections-3.2.2.jar, but not monkeying around with a .war file.  Has anyone ran into this issue?

0 Kudos
0 Replies