{"action":"opened","issue":{"url":"https://api.github.com/repos/jowein/fs-agent/issues/567","repository_url":"https://api.github.com/repos/jowein/fs-agent","labels_url":"https://api.github.com/repos/jowein/fs-agent/issues/567/labels{/name}","comments_url":"https://api.github.com/repos/jowein/fs-agent/issues/567/comments","events_url":"https://api.github.com/repos/jowein/fs-agent/issues/567/events","html_url":"https://github.com/jowein/fs-agent/issues/567","id":362339221,"node_id":"MDU6SXNzdWUzNjIzMzkyMjE=","number":567,"title":"CVE-2016-1000338 High severity vulnerability detected by WhiteSource","user":{"login":"thunderalpha1[bot]","id":42357622,"node_id":"MDM6Qm90NDIzNTc2MjI=","avatar_url":"https://avatars1.githubusercontent.com/u/3177372?v=4","gravatar_id":"","url":"https://api.github.com/users/thunderalpha1%5Bbot%5D","html_url":"https://github.com/apps/thunderalpha1","followers_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/followers","following_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/repos","events_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-20T19:48:05Z","updated_at":"2018-09-20T19:48:05Z","closed_at":null,"author_association":"NONE","body":"## CVE-2016-1000338 - High Vulnerability\n<details><summary>:warning: Vulnerable Library - <b>bcprov-jdk15on-1.50.jar</b></p></summary>\n<p>path: C:\\Users\\YossiW\\.m2\\repository\\org\\bouncycastle\\bcprov-jdk15on\\1.50\\bcprov-jdk15on-1.50.jar</p>\n<p>\n\nDependency Hierarchy:\n  - redline-1.2.1.jar (Root Library)\n    - bcpg-jdk15on-1.50.jar\n      - :x: **bcprov-jdk15on-1.50.jar** (Vulnerable Library)\n<p>Found in commit: <a href=\"https://github.com/jowein/fs-agent/commit/dc73c92d3b19cbeb04dc732433c952a75503fb87\">dc73c92d3b19cbeb04dc732433c952a75503fb87</a></p>\n</p>\n</details>\n<p></p>\n<details><summary>:red_circle: Vulnerability Details</summary>\n<p>  \n  \nIn Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.\n\n<p>Publish Date: 2018-06-01\n<p>URL: <a href=https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000338>CVE-2016-1000338</a></p>\n</p>\n</details>\n<p></p>\n<details><summary>:dart: CVSS 3 Score Details (<b>7.5</b>)</summary>\n<p>\n\nBase Score Metrics:\n- Exploitability Metrics:\n  - Attack Vector: Network\n  - Attack Complexity: Low\n  - Privileges Required: None\n  - User Interaction: None\n  - Scope: Unchanged\n- Impact Metrics:\n  - Confidentiality Impact: None\n  - Integrity Impact: High\n  - Availability Impact: None\n</p>\nFor more information on CVSS3 Scores, click <a href=\"https://www.first.org/cvss/calculator/3.0\">here</a>.\n</p>\n</details>\n<p></p>\n<details><summary>:white_check_mark: Suggested Fix</summary>\n<p>\n\n<p>Type: Change files</p>\n<p>Origin: <a href=\"https://github.com/bcgit/bc-java/commit/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0\">https://github.com/bcgit/bc-java/commit/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0</a></p>\n<p>Release Date: 2016-10-13</p>\n<p>Fix Resolution: Replace or update the following files: DSASigner.java, DSATest.java</p>\n\n</p>\n</details>\n<p></p>\n\n***\nWant to learn more about the open source vulnerabilities in your products? Click [here](https://www.whitesourcesoftware.com)"}}
{"actor":{"display_login":"thunderalpha1"}}