{"action":"created","issue":{"url":"https://api.github.com/repos/SAP/smp_mobiliser_template/issues/8","repository_url":"https://api.github.com/repos/SAP/smp_mobiliser_template","labels_url":"https://api.github.com/repos/SAP/smp_mobiliser_template/issues/8/labels{/name}","comments_url":"https://api.github.com/repos/SAP/smp_mobiliser_template/issues/8/comments","events_url":"https://api.github.com/repos/SAP/smp_mobiliser_template/issues/8/events","html_url":"https://github.com/SAP/smp_mobiliser_template/pull/8","id":139694366,"number":8,"title":"Upgrade Apache Commons Collections to v3.2.2","user":{"login":"erikhaugen","id":1815913,"avatar_url":"https://avatars.githubusercontent.com/u/1815913?v=3","gravatar_id":"","url":"https://api.github.com/users/erikhaugen","html_url":"https://github.com/erikhaugen","followers_url":"https://api.github.com/users/erikhaugen/followers","following_url":"https://api.github.com/users/erikhaugen/following{/other_user}","gists_url":"https://api.github.com/users/erikhaugen/gists{/gist_id}","starred_url":"https://api.github.com/users/erikhaugen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erikhaugen/subscriptions","organizations_url":"https://api.github.com/users/erikhaugen/orgs","repos_url":"https://api.github.com/users/erikhaugen/repos","events_url":"https://api.github.com/users/erikhaugen/events{/privacy}","received_events_url":"https://api.github.com/users/erikhaugen/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-09T20:38:31Z","updated_at":"2016-03-10T16:51:14Z","closed_at":"2016-03-10T16:51:05Z","pull_request":{"url":"https://api.github.com/repos/SAP/smp_mobiliser_template/pulls/8","html_url":"https://github.com/SAP/smp_mobiliser_template/pull/8","diff_url":"https://github.com/SAP/smp_mobiliser_template/pull/8.diff","patch_url":"https://github.com/SAP/smp_mobiliser_template/pull/8.patch"},"body":"Version 3.2.1 has a CVSS 10.0 vulnerability. That's the worst kind of\r\nvulnerability that exists. By merely existing on the classpath, this\r\nlibrary causes the Java serialization parser for the entire JVM process\r\nto go from being a state machine to a turing machine. A turing machine\r\nwith an exec() function!\r\n\r\nhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8103\r\nhttps://commons.apache.org/proper/commons-collections/security-reports.html\r\nhttp://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"},"comment":{"url":"https://api.github.com/repos/SAP/smp_mobiliser_template/issues/comments/194949129","html_url":"https://github.com/SAP/smp_mobiliser_template/pull/8#issuecomment-194949129","issue_url":"https://api.github.com/repos/SAP/smp_mobiliser_template/issues/8","id":194949129,"user":{"login":"aclemons","id":346774,"avatar_url":"https://avatars.githubusercontent.com/u/346774?v=3","gravatar_id":"","url":"https://api.github.com/users/aclemons","html_url":"https://github.com/aclemons","followers_url":"https://api.github.com/users/aclemons/followers","following_url":"https://api.github.com/users/aclemons/following{/other_user}","gists_url":"https://api.github.com/users/aclemons/gists{/gist_id}","starred_url":"https://api.github.com/users/aclemons/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aclemons/subscriptions","organizations_url":"https://api.github.com/users/aclemons/orgs","repos_url":"https://api.github.com/users/aclemons/repos","events_url":"https://api.github.com/users/aclemons/events{/privacy}","received_events_url":"https://api.github.com/users/aclemons/received_events","type":"User","site_admin":false},"created_at":"2016-03-10T16:51:14Z","updated_at":"2016-03-10T16:51:14Z","body":"Thanks"}}