Wanted to check if there was a new community edition of commons-collections.jar for 4.2.3 GA created to resolve the deserialization CVE-2015-7501 issues or if the proposed steps would be to manually modify the existing jar directly removing the InvokerTransformer, InstantiateFactory, and InstantiateTransformer classes from all commons-collections.jar? Thanks in advance,
