{"action":"opened","issue":{"url":"https://api.github.com/repos/yoswein/fs-agent/issues/93","repository_url":"https://api.github.com/repos/yoswein/fs-agent","labels_url":"https://api.github.com/repos/yoswein/fs-agent/issues/93/labels{/name}","comments_url":"https://api.github.com/repos/yoswein/fs-agent/issues/93/comments","events_url":"https://api.github.com/repos/yoswein/fs-agent/issues/93/events","html_url":"https://github.com/yoswein/fs-agent/issues/93","id":363263718,"node_id":"MDU6SXNzdWUzNjMyNjM3MTg=","number":93,"title":"CVE-2016-1000352 High severity vulnerability detected by WhiteSource","user":{"login":"thunderalpha1[bot]","id":42357622,"node_id":"MDM6Qm90NDIzNTc2MjI=","avatar_url":"https://avatars1.githubusercontent.com/u/3177372?v=4","gravatar_id":"","url":"https://api.github.com/users/thunderalpha1%5Bbot%5D","html_url":"https://github.com/apps/thunderalpha1","followers_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/followers","following_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/repos","events_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-24T18:20:16Z","updated_at":"2018-09-24T18:20:16Z","closed_at":null,"author_association":"NONE","body":"## CVE-2016-1000352 - High Vulnerability\n<details><summary>:warning: Vulnerable Library - <b>bcprov-jdk15on-1.50.jar</b></p></summary>\n<p>path: C:\\Users\\YossiW\\.m2\\repository\\org\\bouncycastle\\bcprov-jdk15on\\1.50\\bcprov-jdk15on-1.50.jar</p>\n<p>\n\nDependency Hierarchy:\n  - redline-1.2.1.jar (Root Library)\n    - bcpg-jdk15on-1.50.jar\n      - :x: **bcprov-jdk15on-1.50.jar** (Vulnerable Library)\n<p>Found in commit: <a href=\"https://github.com/yoswein/fs-agent/commit/83cc934987f94762d699c07adea3cb1a4f441ef2\">83cc934987f94762d699c07adea3cb1a4f441ef2</a></p>\n</p>\n</details>\n<p></p>\n<details><summary>:red_circle: Vulnerability Details</summary>\n<p>  \n  \nIn the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.\n\n<p>Publish Date: 2018-06-04\n<p>URL: <a href=https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000352>CVE-2016-1000352</a></p>\n</p>\n</details>\n<p></p>\n<details><summary>:dart: CVSS 3 Score Details (<b>7.4</b>)</summary>\n<p>\n\nBase Score Metrics:\n- Exploitability Metrics:\n  - Attack Vector: Network\n  - Attack Complexity: High\n  - Privileges Required: None\n  - User Interaction: None\n  - Scope: Unchanged\n- Impact Metrics:\n  - Confidentiality Impact: High\n  - Integrity Impact: High\n  - Availability Impact: None\n</p>\nFor more information on CVSS3 Scores, click <a href=\"https://www.first.org/cvss/calculator/3.0\">here</a>.\n</p>\n</details>\n<p></p>\n<details><summary>:white_check_mark: Suggested Fix</summary>\n<p>\n\n<p>Type: Change files</p>\n<p>Origin: <a href=\"https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f\">https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f</a></p>\n<p>Release Date: 2016-08-26</p>\n<p>Fix Resolution: Replace or update the following files: ECIESTest.java, IESUtil.java, AlgorithmParametersSpi.java, EC.java, IESCipher.java, ECIESVectorTest.java, IESParameterSpec.java, DHIESTest.java, DH.java, IESCipher.java</p>\n\n</p>\n</details>\n<p></p>\n\n***\nWant to learn more about the open source vulnerabilities in your products? Click [here](https://www.whitesourcesoftware.com)"}}
{"actor":{"display_login":"thunderalpha1"}}