{"push_id":1012772897,"size":1,"distinct_size":1,"ref":"refs/heads/patch-1","head":"97661b28a35e047e9d5dd7d22d1db2cb8fe3e37e","before":"88ef578ee8a868239ad28e771954bcf016bacac4","commits":[{"sha":"97661b28a35e047e9d5dd7d22d1db2cb8fe3e37e","author":{"email":"2591e5f46f28d303f9dc027d475a5c60d8dea17a@van.derveer.com","name":"Dan Van Derveer"},"message":"Upgrade Apache Commons Collections to v3.2.2\n\nVersion 3.2.1 has a CVSS 10.0 vulnerability. That's the worst kind of\r\nvulnerability that exists. By merely existing on the classpath, this\r\nlibrary causes the Java serialization parser for the entire JVM process\r\nto go from being a state machine to a turing machine. A turing machine\r\nwith an exec() function!\r\n\r\nhttps://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8103\r\nhttps://commons.apache.org/proper/commons-collections/security-reports.html\r\nhttp://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","distinct":true,"url":"https://api.github.com/repos/cyberkni/Personalization-framework/commits/97661b28a35e047e9d5dd7d22d1db2cb8fe3e37e"}]}