From 5f96c415e3a202a15f04bbd856779de22830c506 Mon Sep 17 00:00:00 2001
From: Dave Syer <dsyer@pivotal.io>
Date: Thu, 22 Sep 2016 16:22:16 +0100
Subject: [PATCH] Upgrade xstream to 1.4.9

Fixes XXE vulnerability in Eureka Server (external entity processing
on by default in older versions of the library).
---
 spring-cloud-netflix-dependencies/pom.xml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/spring-cloud-netflix-dependencies/pom.xml b/spring-cloud-netflix-dependencies/pom.xml
index 50673b89..a687c147 100644
--- a/spring-cloud-netflix-dependencies/pom.xml
+++ b/spring-cloud-netflix-dependencies/pom.xml
@@ -25,6 +25,7 @@
 		<java.version>1.7</java.version>
 		<turbine.version>1.0.0</turbine.version>
 		<eureka-jersey.version>1.19.1</eureka-jersey.version>
+		<xstream.version>1.4.9</xstream.version>
 	</properties>
 	<dependencyManagement>
 		<dependencies>
@@ -275,7 +276,7 @@
 			<dependency>
 				<groupId>com.thoughtworks.xstream</groupId>
 				<artifactId>xstream</artifactId>
-				<version>1.4.2</version>
+				<version>${xstream.version}</version>
 			</dependency>
 			<dependency>
 				<groupId>io.github.openfeign</groupId>