{"action":"created","issue":{"url":"https://api.github.com/repos/UniversalMediaServer/UniversalMediaServer/issues/1023","repository_url":"https://api.github.com/repos/UniversalMediaServer/UniversalMediaServer","labels_url":"https://api.github.com/repos/UniversalMediaServer/UniversalMediaServer/issues/1023/labels{/name}","comments_url":"https://api.github.com/repos/UniversalMediaServer/UniversalMediaServer/issues/1023/comments","events_url":"https://api.github.com/repos/UniversalMediaServer/UniversalMediaServer/issues/1023/events","html_url":"https://github.com/UniversalMediaServer/UniversalMediaServer/issues/1023","id":180065451,"number":1023,"title":"Study on OSS maven library vulnerabilities: httpclient library","user":{"login":"raux","id":5723643,"avatar_url":"https://avatars.githubusercontent.com/u/5723643?v=3","gravatar_id":"","url":"https://api.github.com/users/raux","html_url":"https://github.com/raux","followers_url":"https://api.github.com/users/raux/followers","following_url":"https://api.github.com/users/raux/following{/other_user}","gists_url":"https://api.github.com/users/raux/gists{/gist_id}","starred_url":"https://api.github.com/users/raux/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/raux/subscriptions","organizations_url":"https://api.github.com/users/raux/orgs","repos_url":"https://api.github.com/users/raux/repos","events_url":"https://api.github.com/users/raux/events{/privacy}","received_events_url":"https://api.github.com/users/raux/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-09-29T14:30:26Z","updated_at":"2016-09-29T15:42:22Z","closed_at":null,"body":"Dear Github OSS Developer,\r\n\r\nMy name is Raula Kula, a research assistant prof at Osaka University, Japan. Currently I am studying the maintenance of Maven Libraries. I am currently focused on OSS vulnerabilities and the varying reasons for library migration.\r\n\r\nAs a part of my study I particularity focused on the commons-httpclient library. http://hc.apache.org/httpclient-3.x/ and the CVE-2012-5783 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5783, announced on 11/04/2012 and revisited 11/24/2015, which affects versions up to 3.x.\r\n\r\nWe noticed that your project on Github is still configured to depend on a vulnerable version of fileupload (3.1) at {https://github.com/UniversalMediaServer/UniversalMediaServer/blob/master/pom.xml}\r\n\r\nWe understand that there are many reasons for not migrating, thus we be appreciate if you could simply detail the following:\r\n\r\n1. Were you aware of the vulnerability? If so, then how long ago.\r\n2. What are some factors that influence you not to update.\r\n3. Does you project employ a update strategy, to check and update versions of currently used libraries?\r\n\r\nAlso feel free to detail any other information to help us understand your decision. Again, thank you for taking your time off your busy schedule and hope to hear from you soon.\r\nPlease note that we respect your confidentiality, so we will not disclose any personal details in the study.\r\n\r\nSincerely,\r\nRaula Kula"},"comment":{"url":"https://api.github.com/repos/UniversalMediaServer/UniversalMediaServer/issues/comments/250504507","html_url":"https://github.com/UniversalMediaServer/UniversalMediaServer/issues/1023#issuecomment-250504507","issue_url":"https://api.github.com/repos/UniversalMediaServer/UniversalMediaServer/issues/1023","id":250504507,"user":{"login":"Nadahar","id":12900583,"avatar_url":"https://avatars.githubusercontent.com/u/12900583?v=3","gravatar_id":"","url":"https://api.github.com/users/Nadahar","html_url":"https://github.com/Nadahar","followers_url":"https://api.github.com/users/Nadahar/followers","following_url":"https://api.github.com/users/Nadahar/following{/other_user}","gists_url":"https://api.github.com/users/Nadahar/gists{/gist_id}","starred_url":"https://api.github.com/users/Nadahar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Nadahar/subscriptions","organizations_url":"https://api.github.com/users/Nadahar/orgs","repos_url":"https://api.github.com/users/Nadahar/repos","events_url":"https://api.github.com/users/Nadahar/events{/privacy}","received_events_url":"https://api.github.com/users/Nadahar/received_events","type":"User","site_admin":false},"created_at":"2016-09-29T15:42:22Z","updated_at":"2016-09-29T15:42:22Z","body":"I can't answer for the group, but generally there are so many security vulnerabilities that it's a full time job just to keep up with them all. In most cases they don't apply. When it comes to this specific vulnerability ```org.apache.commons.httpclient``` is only used by UMS by the automatic update, and there's no SSL or encryption involved."}}
{"actor":{"display_login":"Nadahar"}}