{"action":"created","issue":{"url":"https://api.github.com/repos/log4js-node/log4js-node/issues/706","repository_url":"https://api.github.com/repos/log4js-node/log4js-node","labels_url":"https://api.github.com/repos/log4js-node/log4js-node/issues/706/labels{/name}","comments_url":"https://api.github.com/repos/log4js-node/log4js-node/issues/706/comments","events_url":"https://api.github.com/repos/log4js-node/log4js-node/issues/706/events","html_url":"https://github.com/log4js-node/log4js-node/issues/706","id":321996630,"number":706,"title":"log4js pulls in security vulnerabilities","user":{"login":"kolbma","id":5228369,"avatar_url":"https://avatars2.githubusercontent.com/u/5228369?v=4","gravatar_id":"","url":"https://api.github.com/users/kolbma","html_url":"https://github.com/kolbma","followers_url":"https://api.github.com/users/kolbma/followers","following_url":"https://api.github.com/users/kolbma/following{/other_user}","gists_url":"https://api.github.com/users/kolbma/gists{/gist_id}","starred_url":"https://api.github.com/users/kolbma/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kolbma/subscriptions","organizations_url":"https://api.github.com/users/kolbma/orgs","repos_url":"https://api.github.com/users/kolbma/repos","events_url":"https://api.github.com/users/kolbma/events{/privacy}","received_events_url":"https://api.github.com/users/kolbma/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-05-10T16:32:29Z","updated_at":"2018-05-11T23:46:55Z","closed_at":null,"author_association":"NONE","body":"via mailgun-js\r\n\r\n```\r\n┌────────────┬────────────────────────────────────────────────────────────────────┐\r\n│            │ Denial of Service                                                  │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Name       │ http-proxy-agent                                                   │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ CVSS       │ 8 (High)                                                           │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Installed  │ 1.0.0                                                              │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Vulnerable │ <=2.0.0                                                            │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Patched    │ >=2.1.0                                                            │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Path       │ nodejs-intro-testing-sample@0.0.1 > karma@2.0.2 > log4js@2.5.3 >   │\r\n│            │ mailgun-js@0.7.15 > proxy-agent@2.0.0 > http-proxy-agent@1.0.0     │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ More Info  │ https://nodesecurity.io/advisories/607                             │\r\n└────────────┴────────────────────────────────────────────────────────────────────┘\r\n\r\n┌────────────┬────────────────────────────────────────────────────────────────────┐\r\n│            │ Denial of Service                                                  │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Name       │ https-proxy-agent                                                  │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ CVSS       │ 8 (High)                                                           │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Installed  │ 1.0.0                                                              │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Vulnerable │ <=2.1.1                                                            │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Patched    │ >=2.2.0                                                            │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Path       │ nodejs-intro-testing-sample@0.0.1 > karma@2.0.2 > log4js@2.5.3 >   │\r\n│            │ mailgun-js@0.7.15 > proxy-agent@2.0.0 > https-proxy-agent@1.0.0    │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ More Info  │ https://nodesecurity.io/advisories/593                             │\r\n└────────────┴────────────────────────────────────────────────────────────────────┘\r\n\r\n┌────────────┬────────────────────────────────────────────────────────────────────┐\r\n│            │ Regular Expression Denial of Service                               │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Name       │ timespan                                                           │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ CVSS       │ 3.7 (Low)                                                          │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Installed  │ 2.3.0                                                              │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Vulnerable │ All                                                                │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Patched    │ None                                                               │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Path       │ nodejs-intro-testing-sample@0.0.1 > karma@2.0.2 > log4js@2.5.3 >   │\r\n│            │ loggly@1.1.1 > timespan@2.3.0                                      │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ More Info  │ https://nodesecurity.io/advisories/533                             │\r\n└────────────┴────────────────────────────────────────────────────────────────────┘\r\n\r\n┌────────────┬────────────────────────────────────────────────────────────────────┐\r\n│            │ Regular Expression Denial of Service                               │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Name       │ debug                                                              │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ CVSS       │ 3.7 (Low)                                                          │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Installed  │ 2.2.0                                                              │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Vulnerable │ <= 2.6.8 || >= 3.0.0 <= 3.0.1                                      │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Patched    │ >= 2.6.9 < 3.0.0 || >= 3.1.0                                       │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ Path       │ nodejs-intro-testing-sample@0.0.1 > karma@2.0.2 > log4js@2.5.3 >   │\r\n│            │ mailgun-js@0.7.15 > debug@2.2.0                                    │\r\n├────────────┼────────────────────────────────────────────────────────────────────┤\r\n│ More Info  │ https://nodesecurity.io/advisories/534                             │\r\n└────────────┴────────────────────────────────────────────────────────────────────┘\r\n```"},"comment":{"url":"https://api.github.com/repos/log4js-node/log4js-node/issues/comments/388512073","html_url":"https://github.com/log4js-node/log4js-node/issues/706#issuecomment-388512073","issue_url":"https://api.github.com/repos/log4js-node/log4js-node/issues/706","id":388512073,"user":{"login":"nomiddlename","id":83909,"avatar_url":"https://avatars3.githubusercontent.com/u/83909?v=4","gravatar_id":"","url":"https://api.github.com/users/nomiddlename","html_url":"https://github.com/nomiddlename","followers_url":"https://api.github.com/users/nomiddlename/followers","following_url":"https://api.github.com/users/nomiddlename/following{/other_user}","gists_url":"https://api.github.com/users/nomiddlename/gists{/gist_id}","starred_url":"https://api.github.com/users/nomiddlename/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nomiddlename/subscriptions","organizations_url":"https://api.github.com/users/nomiddlename/orgs","repos_url":"https://api.github.com/users/nomiddlename/repos","events_url":"https://api.github.com/users/nomiddlename/events{/privacy}","received_events_url":"https://api.github.com/users/nomiddlename/received_events","type":"User","site_admin":false},"created_at":"2018-05-11T23:46:55Z","updated_at":"2018-05-11T23:46:55Z","author_association":"COLLABORATOR","body":"I want to get all the optional appenders deprecated before I release 3.x, I'm about halfway through that. I can't give you a timetable, because I only have a couple of hours a week to spend on this and I'm doing it for free.\r\n\r\nI'll take a look at updating the mailgun dependency, and see if it breaks anything."}}
{"actor":{"display_login":"nomiddlename"}}