{"action":"created","issue":{"url":"https://api.github.com/repos/carewebframework/carewebframework-core/issues/3","repository_url":"https://api.github.com/repos/carewebframework/carewebframework-core","labels_url":"https://api.github.com/repos/carewebframework/carewebframework-core/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/carewebframework/carewebframework-core/issues/3/comments","events_url":"https://api.github.com/repos/carewebframework/carewebframework-core/issues/3/events","html_url":"https://github.com/carewebframework/carewebframework-core/pull/3","id":139707059,"number":3,"title":"Upgrade Apache Commons Collections to v3.2.2","user":{"login":"iflan","id":7514156,"avatar_url":"https://avatars.githubusercontent.com/u/7514156?v=3","gravatar_id":"","url":"https://api.github.com/users/iflan","html_url":"https://github.com/iflan","followers_url":"https://api.github.com/users/iflan/followers","following_url":"https://api.github.com/users/iflan/following{/other_user}","gists_url":"https://api.github.com/users/iflan/gists{/gist_id}","starred_url":"https://api.github.com/users/iflan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iflan/subscriptions","organizations_url":"https://api.github.com/users/iflan/orgs","repos_url":"https://api.github.com/users/iflan/repos","events_url":"https://api.github.com/users/iflan/events{/privacy}","received_events_url":"https://api.github.com/users/iflan/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-03-09T21:35:55Z","updated_at":"2016-03-10T18:09:22Z","closed_at":"2016-03-10T16:05:42Z","pull_request":{"url":"https://api.github.com/repos/carewebframework/carewebframework-core/pulls/3","html_url":"https://github.com/carewebframework/carewebframework-core/pull/3","diff_url":"https://github.com/carewebframework/carewebframework-core/pull/3.diff","patch_url":"https://github.com/carewebframework/carewebframework-core/pull/3.patch"},"body":"Version 3.2.1 has a CVSS 10.0 vulnerability. That's the worst kind of\r\nvulnerability that exists. By merely existing on the classpath, this\r\nlibrary causes the Java serialization parser for the entire JVM process\r\nto go from being a state machine to a turing machine. A turing machine\r\nwith an exec() function!\r\n\r\nhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8103\r\nhttps://commons.apache.org/proper/commons-collections/security-reports.html\r\nhttp://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"},"comment":{"url":"https://api.github.com/repos/carewebframework/carewebframework-core/issues/comments/194981543","html_url":"https://github.com/carewebframework/carewebframework-core/pull/3#issuecomment-194981543","issue_url":"https://api.github.com/repos/carewebframework/carewebframework-core/issues/3","id":194981543,"user":{"login":"mdgeek","id":2183598,"avatar_url":"https://avatars.githubusercontent.com/u/2183598?v=3","gravatar_id":"","url":"https://api.github.com/users/mdgeek","html_url":"https://github.com/mdgeek","followers_url":"https://api.github.com/users/mdgeek/followers","following_url":"https://api.github.com/users/mdgeek/following{/other_user}","gists_url":"https://api.github.com/users/mdgeek/gists{/gist_id}","starred_url":"https://api.github.com/users/mdgeek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mdgeek/subscriptions","organizations_url":"https://api.github.com/users/mdgeek/orgs","repos_url":"https://api.github.com/users/mdgeek/repos","events_url":"https://api.github.com/users/mdgeek/events{/privacy}","received_events_url":"https://api.github.com/users/mdgeek/received_events","type":"User","site_admin":false},"created_at":"2016-03-10T18:09:22Z","updated_at":"2016-03-10T18:09:22Z","body":"Thanks, Ian.\n\nFrom:  Ian Flanigan <notifications@github.com>\nReply-To:  carewebframework/carewebframework-core <reply@reply.github.com>\nDate:  Thursday, March 10, 2016 at 11:05 AM\nTo:  carewebframework/carewebframework-core <carewebframework-core@noreply.github.com>\nCc:  Doug Martin <martindk@email.com>\nSubject:  Re: [carewebframework-core] Upgrade Apache Commons Collections to v3.2.2 (#3)\n\n\nI'm going to close this PR since you've fixed it internally.\n\n—\nReply to this email directly or view it on GitHub.\n\n  \n\n"}}