{"action":"opened","issue":{"url":"https://api.github.com/repos/jowein/fs-agent/issues/104","repository_url":"https://api.github.com/repos/jowein/fs-agent","labels_url":"https://api.github.com/repos/jowein/fs-agent/issues/104/labels{/name}","comments_url":"https://api.github.com/repos/jowein/fs-agent/issues/104/comments","events_url":"https://api.github.com/repos/jowein/fs-agent/issues/104/events","html_url":"https://github.com/jowein/fs-agent/issues/104","id":358754331,"node_id":"MDU6SXNzdWUzNTg3NTQzMzE=","number":104,"title":"CVE-2018-1000613: medium vulnerability was reported by WS","user":{"login":"thunderalpha1[bot]","id":42357622,"node_id":"MDM6Qm90NDIzNTc2MjI=","avatar_url":"https://avatars1.githubusercontent.com/u/3177372?v=4","gravatar_id":"","url":"https://api.github.com/users/thunderalpha1%5Bbot%5D","html_url":"https://github.com/apps/thunderalpha1","followers_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/followers","following_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/repos","events_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/thunderalpha1%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":1016163372,"node_id":"MDU6TGFiZWwxMDE2MTYzMzcy","url":"https://api.github.com/repos/jowein/fs-agent/labels/WS_LABEL","name":"WS_LABEL","color":"ffd600","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-10T19:08:13Z","updated_at":"2018-09-10T19:08:13Z","closed_at":null,"author_association":"NONE","body":"## CVE-2018-1000613 - medium Vulnerability\n<details><summary>:warning: Vulnerable Library - <b>bcprov-jdk15on-1.50.jar</b> (path: C:\\Users\\YossiW\\.m2\\reposi...)</p></summary>\n<p>\n\nDependency Hierarchy:\n  - redline-1.2.1.jar (Root Library)\n    - Bouncy Castle OpenPGP API\n      - :x: **Bouncy Castle Provider** (Vulnerable Library)\n</p>\n</details>\n<p></p>\n<details><summary>:red_circle: Vulnerability Details</summary>\n<p>  \n  \nLegion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs version prior to version 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code.. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application.. This vulnerability appears to have been fixed in 1.60 and later.\n\n<p>Publish Date: 2018-07-08\n<p>URL: <a href=https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000613>CVE-2018-1000613</a></p>\n</p>\n</details>\n<p></p>\n<details><summary>:dart: CVSS 2 Score Details (<b>4.9</b>)</summary>\n<p>\n\nBase ScoreMarkdownParams Metrics:\n- Exploitability Metrics:\n  - Attack Vector: N/A\n  - Attack Complexity: N/A\n  - Privileges Required: N/A\n  - User Interaction: N/A\n  - Scope: N/A\n- Impact Metrics:\n  - Confidentiality Impact: N/A\n  - Integrity Impact: N/A\n  - Availability Impact: N/A\n</p>\n\n</p>\n</details>\n<p></p>\n<details><summary>:white_check_mark: Suggested Fix</summary>\n<p>\n\n<p>Type: CHANGE_FILES</p>\n<p>Origin: <a href=\"https://github.com/bcgit/bc-java/commit/cd98322b171b15b3f88c5ec871175147893c31e6#diff-148a6c098af0199192d6aede960f45dc\">https://github.com/bcgit/bc-java/commit/cd98322b171b15b3f88c5ec871175147893c31e6#diff-148a6c098af0199192d6aede960f45dc</a> (CHANGE_FILES)</p>\n<p>Release Date: 2018-03-02</p>\n<p>Fix Resolution: null</p>\n\n</p>\n</details>\n<p></p>\n\n***\nWant to learn more about the open source vulnerabilities in your products? Click [here](https://www.whitesourcesoftware.com)"}}
{"actor":{"display_login":"thunderalpha1"}}