{"push_id":1011341264,"size":1,"distinct_size":1,"ref":"refs/heads/trunk","head":"e180f669e6afbd75aca8374c7a38cd81a3b6976d","before":"fb02141cf7c9acb37ac5c3cdfe2b3954b389cfc6","commits":[{"sha":"e180f669e6afbd75aca8374c7a38cd81a3b6976d","author":{"email":"058d2bda71f8f6c71096eb399a73729ca6a2358e@google.com","name":"Laetitia Baudoin"},"message":"Upgrade Apache Commons Collections to v3.2.2\n\nVersion 3.2.1 has a CVSS 10.0 vulnerability. That's the worst kind of\nvulnerability that exists. By merely existing on the classpath, this\nlibrary causes the Java serialization parser for the entire JVM process\nto go from being a state machine to a turing machine. A turing machine\nwith an exec() function!\n\nhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8103\nhttps://commons.apache.org/proper/commons-collections/security-reports.html\nhttp://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","distinct":true,"url":"https://api.github.com/repos/lbaudoin/directory-server/commits/e180f669e6afbd75aca8374c7a38cd81a3b6976d"}]}