{"action":"created","issue":{"url":"https://api.github.com/repos/appaloosa-store/appaloosa_client/issues/6","repository_url":"https://api.github.com/repos/appaloosa-store/appaloosa_client","labels_url":"https://api.github.com/repos/appaloosa-store/appaloosa_client/issues/6/labels{/name}","comments_url":"https://api.github.com/repos/appaloosa-store/appaloosa_client/issues/6/comments","events_url":"https://api.github.com/repos/appaloosa-store/appaloosa_client/issues/6/events","html_url":"https://github.com/appaloosa-store/appaloosa_client/issues/6","id":346201421,"node_id":"MDU6SXNzdWUzNDYyMDE0MjE=","number":6,"title":"Unsecure dependencies of Appaloosa client","user":{"login":"mcBIG","id":1875287,"node_id":"MDQ6VXNlcjE4NzUyODc=","avatar_url":"https://avatars2.githubusercontent.com/u/1875287?v=4","gravatar_id":"","url":"https://api.github.com/users/mcBIG","html_url":"https://github.com/mcBIG","followers_url":"https://api.github.com/users/mcBIG/followers","following_url":"https://api.github.com/users/mcBIG/following{/other_user}","gists_url":"https://api.github.com/users/mcBIG/gists{/gist_id}","starred_url":"https://api.github.com/users/mcBIG/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mcBIG/subscriptions","organizations_url":"https://api.github.com/users/mcBIG/orgs","repos_url":"https://api.github.com/users/mcBIG/repos","events_url":"https://api.github.com/users/mcBIG/events{/privacy}","received_events_url":"https://api.github.com/users/mcBIG/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-07-31T14:01:05Z","updated_at":"2018-11-27T12:02:56Z","closed_at":null,"author_association":"NONE","body":"Hi, i am using your client for uploading application artifacts to Appaloosa store. Thanks for your work :)\r\nI recently discovered security issues inside dependencies of this client. More specifically in org.apache.httpcomponents:httpmime:4.2.5 and org.apache.httpcomponents:httpclient:4.2.5. \r\n\r\nHere is list of issues:\r\n\r\nCVE-2014-3577\r\norg.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a \"CN=\" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the \"foo,CN=www.apache.org\" string in the O field.\r\n\r\nCVE-2015-5262\r\nhttp/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.\r\n\r\nWould it be possible to update these dependencies?\r\n"},"comment":{"url":"https://api.github.com/repos/appaloosa-store/appaloosa_client/issues/comments/442034453","html_url":"https://github.com/appaloosa-store/appaloosa_client/issues/6#issuecomment-442034453","issue_url":"https://api.github.com/repos/appaloosa-store/appaloosa_client/issues/6","id":442034453,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MjAzNDQ1Mw==","user":{"login":"benoittgt","id":8417720,"node_id":"MDQ6VXNlcjg0MTc3MjA=","avatar_url":"https://avatars3.githubusercontent.com/u/8417720?v=4","gravatar_id":"","url":"https://api.github.com/users/benoittgt","html_url":"https://github.com/benoittgt","followers_url":"https://api.github.com/users/benoittgt/followers","following_url":"https://api.github.com/users/benoittgt/following{/other_user}","gists_url":"https://api.github.com/users/benoittgt/gists{/gist_id}","starred_url":"https://api.github.com/users/benoittgt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benoittgt/subscriptions","organizations_url":"https://api.github.com/users/benoittgt/orgs","repos_url":"https://api.github.com/users/benoittgt/repos","events_url":"https://api.github.com/users/benoittgt/events{/privacy}","received_events_url":"https://api.github.com/users/benoittgt/received_events","type":"User","site_admin":false},"created_at":"2018-11-27T12:02:56Z","updated_at":"2018-11-27T12:02:56Z","author_association":"CONTRIBUTOR","body":"Hello @mcBIG \r\n\r\nSorry for the delay. We will soon release a new version with updated packages."}}
{"actor":{"display_login":"benoittgt"}}