{"action":"opened","issue":{"url":"https://api.github.com/repos/depshield-ci/ci-project-4/issues/32","repository_url":"https://api.github.com/repos/depshield-ci/ci-project-4","labels_url":"https://api.github.com/repos/depshield-ci/ci-project-4/issues/32/labels{/name}","comments_url":"https://api.github.com/repos/depshield-ci/ci-project-4/issues/32/comments","events_url":"https://api.github.com/repos/depshield-ci/ci-project-4/issues/32/events","html_url":"https://github.com/depshield-ci/ci-project-4/issues/32","id":379029093,"node_id":"MDU6SXNzdWUzNzkwMjkwOTM=","number":32,"title":"[DepShield] Vulnerability due to usage of org.apache.tomcat.embed:tomcat-embed-core:8.5.0","user":{"login":"sonatype-depshield-ci[bot]","id":41704551,"node_id":"MDM6Qm90NDE3MDQ1NTE=","avatar_url":"https://avatars2.githubusercontent.com/u/39319176?v=4","gravatar_id":"","url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D","html_url":"https://github.com/apps/sonatype-depshield-ci","followers_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/followers","following_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/repos","events_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/sonatype-depshield-ci%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-11-09T05:33:08Z","updated_at":"2018-11-09T05:33:08Z","closed_at":null,"author_association":"NONE","body":"DepShield reports that this application's usage of [org.apache.tomcat.embed:tomcat-embed-core:8.5.0](https://ossindex-stage.sonatype.org/component/pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@8.5.0) results in the following vulnerability(s):\n\n- (CVSS **9.8**) [[CVE-2017-5651]  Data Handling](https://ossindex-stage.sonatype.org/vuln/e3682d4a-6238-4460-acc9-77810768b0e1)\n- (CVSS **9.8**) [[CVE-2018-8014] The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to ...](https://ossindex-stage.sonatype.org/vuln/ebc6c182-ca11-472d-86c9-3494de89a103)\n- (CVSS **9.1**) [[CVE-2017-5648]  Improper Access Control](https://ossindex-stage.sonatype.org/vuln/d2432251-64d7-4208-8bd1-1496f0fdbb2c)\n- (CVSS **8.1**) [[CVE-2017-12617] When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC...](https://ossindex-stage.sonatype.org/vuln/a706d966-0a83-4197-9885-737824a04436)\n- (CVSS **8.1**) [[CVE-2016-5388]  Improper Access Control](https://ossindex-stage.sonatype.org/vuln/fc7419cf-e83c-4f5e-9159-92f48bd79fa3)\n- (CVSS **7.5**) [[CVE-2017-5664] The error page mechanism of the Java Servlet Specification requires that, when a...](https://ossindex-stage.sonatype.org/vuln/faf4917a-5a4e-407f-8652-03b16f1785e8)\n- (CVSS **7.5**) [[CVE-2016-6817]  Improper Restriction of Operations within the Bounds of a Memory Buffer](https://ossindex-stage.sonatype.org/vuln/e5e2f0fb-7d57-49eb-b462-89d886c1a12d)\n- (CVSS **7.5**) [[CVE-2017-7675]  Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\")](https://ossindex-stage.sonatype.org/vuln/b71f3f94-8387-4c52-a1f5-d66a155b5b4f)\n- (CVSS **7.5**) [[CVE-2016-3092]  Improper Input Validation](https://ossindex-stage.sonatype.org/vuln/5b1011c7-2093-4c01-a6da-d648b633b26d)\n- (CVSS **7.5**) [[CVE-2017-5650]  Resource Management Errors](https://ossindex-stage.sonatype.org/vuln/d7f4a093-5e01-4425-8bd0-959b663dffe9)\n- (CVSS **7.5**) [[CVE-2016-8745] A bug in the error handling of the send file code for the NIO HTTP connector in ...](https://ossindex-stage.sonatype.org/vuln/da900223-afd6-45f4-9d86-eac708633e3b)\n- (CVSS **7.5**) [[CVE-2017-5647]  Information Exposure](https://ossindex-stage.sonatype.org/vuln/0639bd32-ccd1-4567-9cc8-042be29532f4)\n- (CVSS **7.5**) [[CVE-2016-6797]  Improper Access Control](https://ossindex-stage.sonatype.org/vuln/4871cc07-32c1-49c1-a47a-d1f333f4c346)\n- (CVSS **7.1**) [[CVE-2016-6816]  Improper Input Validation](https://ossindex-stage.sonatype.org/vuln/9d1a1df6-1481-4e68-b3be-942434bd27fc)\n\n<sub>This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for [personal](https://help.github.com/articles/managing-your-personal-account-s-apps/) and [organization](https://help.github.com/articles/managing-your-organization-s-apps/) accounts. Please submit questions or feedback about DepShield to the [Sonatype DepShield Community](https://community.sonatype.com/c/depshield).</sub>"}}
{"actor":{"display_login":"sonatype-depshield-ci"}}