{"action":"created","issue":{"url":"https://api.github.com/repos/RBGKew/powop/issues/1","repository_url":"https://api.github.com/repos/RBGKew/powop","labels_url":"https://api.github.com/repos/RBGKew/powop/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/RBGKew/powop/issues/1/comments","events_url":"https://api.github.com/repos/RBGKew/powop/issues/1/events","html_url":"https://github.com/RBGKew/powop/pull/1","id":139433236,"number":1,"title":"Upgrade Apache Commons Collections to v3.2.2","user":{"login":"gmlewis","id":6598971,"avatar_url":"https://avatars.githubusercontent.com/u/6598971?v=3","gravatar_id":"","url":"https://api.github.com/users/gmlewis","html_url":"https://github.com/gmlewis","followers_url":"https://api.github.com/users/gmlewis/followers","following_url":"https://api.github.com/users/gmlewis/following{/other_user}","gists_url":"https://api.github.com/users/gmlewis/gists{/gist_id}","starred_url":"https://api.github.com/users/gmlewis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gmlewis/subscriptions","organizations_url":"https://api.github.com/users/gmlewis/orgs","repos_url":"https://api.github.com/users/gmlewis/repos","events_url":"https://api.github.com/users/gmlewis/events{/privacy}","received_events_url":"https://api.github.com/users/gmlewis/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-09T00:13:39Z","updated_at":"2016-03-09T08:24:47Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/RBGKew/powop/pulls/1","html_url":"https://github.com/RBGKew/powop/pull/1","diff_url":"https://github.com/RBGKew/powop/pull/1.diff","patch_url":"https://github.com/RBGKew/powop/pull/1.patch"},"body":"\nVersion 3.2.1 has a CVSS 10.0 vulnerability. That is the worst kind of\nvulnerability that exists. By merely existing on the classpath, this\nlibrary causes the Java serialization parser for the entire JVM process\nto go from being a state machine to a turing machine. A turing machine\nwith an exec() function!\n\nhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8103\nhttps://commons.apache.org/proper/commons-collections/security-reports.html\nhttp://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/"},"comment":{"url":"https://api.github.com/repos/RBGKew/powop/issues/comments/194180900","html_url":"https://github.com/RBGKew/powop/pull/1#issuecomment-194180900","issue_url":"https://api.github.com/repos/RBGKew/powop/issues/1","id":194180900,"user":{"login":"lonelyjoeparker","id":9722832,"avatar_url":"https://avatars.githubusercontent.com/u/9722832?v=3","gravatar_id":"","url":"https://api.github.com/users/lonelyjoeparker","html_url":"https://github.com/lonelyjoeparker","followers_url":"https://api.github.com/users/lonelyjoeparker/followers","following_url":"https://api.github.com/users/lonelyjoeparker/following{/other_user}","gists_url":"https://api.github.com/users/lonelyjoeparker/gists{/gist_id}","starred_url":"https://api.github.com/users/lonelyjoeparker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lonelyjoeparker/subscriptions","organizations_url":"https://api.github.com/users/lonelyjoeparker/orgs","repos_url":"https://api.github.com/users/lonelyjoeparker/repos","events_url":"https://api.github.com/users/lonelyjoeparker/events{/privacy}","received_events_url":"https://api.github.com/users/lonelyjoeparker/received_events","type":"User","site_admin":false},"created_at":"2016-03-09T08:24:47Z","updated_at":"2016-03-09T08:24:47Z","body":"_\"But it makes me feel so **complete**!_\" - POWOP codebase\r\n\r\nArf, arf! Sorry, couldn't resist.."}}