{"push_id":2480781937,"size":1,"distinct_size":1,"ref":"refs/heads/stretch","head":"b2b30054606d392a0dbf653ed06fcc23abb6eaf1","before":"b8a566435d0f49d29acfea3654cda356977372c1","commits":[{"sha":"b2b30054606d392a0dbf653ed06fcc23abb6eaf1","author":{"name":"Markus Koschany","email":"165bb958d09bad542688805fdf14b62a87ce4440@debian.org"},"message":"Import Debian changes 8.5.14-1+deb9u2\n\ntomcat8 (8.5.14-1+deb9u2) stretch-security; urgency=high\n\n  * Team upload.\n  * Fix CVE-2017-7674:\n    The CORS Filter did not add an HTTP Vary header indicating that the\n    response varies depending on Origin. This permitted client and server side\n    cache poisoning in some circumstances.\n  * Fix CVE-2017-7675:\n    The HTTP/2 implementation bypassed a number of security checks that\n    prevented directory traversal attacks. It was therefore possible to bypass\n    security constraints using a specially crafted URL.","distinct":true,"url":"https://api.github.com/repos/Debian/tomcat8/commits/b2b30054606d392a0dbf653ed06fcc23abb6eaf1"}]}
{"actor":{"display_login":"debian-bot"}}