{"action":"created","issue":{"url":"https://api.github.com/repos/spotbugs/spotbugs/issues/826","repository_url":"https://api.github.com/repos/spotbugs/spotbugs","labels_url":"https://api.github.com/repos/spotbugs/spotbugs/issues/826/labels{/name}","comments_url":"https://api.github.com/repos/spotbugs/spotbugs/issues/826/comments","events_url":"https://api.github.com/repos/spotbugs/spotbugs/issues/826/events","html_url":"https://github.com/spotbugs/spotbugs/issues/826","id":389984742,"node_id":"MDU6SXNzdWUzODk5ODQ3NDI=","number":826,"title":"jenkins build spotbugs dependency slf4j slf4j-api vulnerability","user":{"login":"datamaskin","id":1183927,"node_id":"MDQ6VXNlcjExODM5Mjc=","avatar_url":"https://avatars2.githubusercontent.com/u/1183927?v=4","gravatar_id":"","url":"https://api.github.com/users/datamaskin","html_url":"https://github.com/datamaskin","followers_url":"https://api.github.com/users/datamaskin/followers","following_url":"https://api.github.com/users/datamaskin/following{/other_user}","gists_url":"https://api.github.com/users/datamaskin/gists{/gist_id}","starred_url":"https://api.github.com/users/datamaskin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/datamaskin/subscriptions","organizations_url":"https://api.github.com/users/datamaskin/orgs","repos_url":"https://api.github.com/users/datamaskin/repos","events_url":"https://api.github.com/users/datamaskin/events{/privacy}","received_events_url":"https://api.github.com/users/datamaskin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-12-11T22:38:17Z","updated_at":"2018-12-12T01:12:54Z","closed_at":null,"author_association":"NONE","body":"Using the spotbugs plugin in my pom and deploying to Jenkins to build subsequently fails due to the slf4j slf4j-api vulnerability:\r\n`/jenkins/jobs/workspace/target/my.jar/META-INF/maven/org.slf4j/slf4j-api/pom.xml , CVE-2018-8088 , Severity: High\r\n\r\norg.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data.\r\n\r\nThe dependency is org.slf4j:slf4j-api:1.8.0-beta2 found in com.github.spotbugs:3.1.9`"},"comment":{"url":"https://api.github.com/repos/spotbugs/spotbugs/issues/comments/446423929","html_url":"https://github.com/spotbugs/spotbugs/issues/826#issuecomment-446423929","issue_url":"https://api.github.com/repos/spotbugs/spotbugs/issues/826","id":446423929,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NjQyMzkyOQ==","user":{"login":"ThrawnCA","id":3080440,"node_id":"MDQ6VXNlcjMwODA0NDA=","avatar_url":"https://avatars3.githubusercontent.com/u/3080440?v=4","gravatar_id":"","url":"https://api.github.com/users/ThrawnCA","html_url":"https://github.com/ThrawnCA","followers_url":"https://api.github.com/users/ThrawnCA/followers","following_url":"https://api.github.com/users/ThrawnCA/following{/other_user}","gists_url":"https://api.github.com/users/ThrawnCA/gists{/gist_id}","starred_url":"https://api.github.com/users/ThrawnCA/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ThrawnCA/subscriptions","organizations_url":"https://api.github.com/users/ThrawnCA/orgs","repos_url":"https://api.github.com/users/ThrawnCA/repos","events_url":"https://api.github.com/users/ThrawnCA/events{/privacy}","received_events_url":"https://api.github.com/users/ThrawnCA/received_events","type":"User","site_admin":false},"created_at":"2018-12-12T01:12:54Z","updated_at":"2018-12-12T01:12:54Z","author_association":"CONTRIBUTOR","body":"Can't we downgrade to 1.7.25?"}}
{"actor":{"display_login":"ThrawnCA"}}