{"action":"opened","issue":{"url":"https://api.github.com/repos/cnmeier/sonatype-depshield-demo/issues/364","repository_url":"https://api.github.com/repos/cnmeier/sonatype-depshield-demo","labels_url":"https://api.github.com/repos/cnmeier/sonatype-depshield-demo/issues/364/labels{/name}","comments_url":"https://api.github.com/repos/cnmeier/sonatype-depshield-demo/issues/364/comments","events_url":"https://api.github.com/repos/cnmeier/sonatype-depshield-demo/issues/364/events","html_url":"https://github.com/cnmeier/sonatype-depshield-demo/issues/364","id":461146214,"node_id":"MDU6SXNzdWU0NjExNDYyMTQ=","number":364,"title":"CVE-2018-19362 (CVSS 7.5) in com.fasterxml.jackson.core : jackson-databind","user":{"login":"webhook-test26[bot]","id":51678737,"node_id":"MDM6Qm90NTE2Nzg3Mzc=","avatar_url":"https://avatars2.githubusercontent.com/u/31703745?v=4","gravatar_id":"","url":"https://api.github.com/users/webhook-test26%5Bbot%5D","html_url":"https://github.com/apps/webhook-test26","followers_url":"https://api.github.com/users/webhook-test26%5Bbot%5D/followers","following_url":"https://api.github.com/users/webhook-test26%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/webhook-test26%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/webhook-test26%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/webhook-test26%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/webhook-test26%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/webhook-test26%5Bbot%5D/repos","events_url":"https://api.github.com/users/webhook-test26%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/webhook-test26%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-06-26T19:37:53Z","updated_at":"2019-06-26T19:37:53Z","closed_at":null,"author_association":"NONE","body":"**CVE ID:** CVE-2018-19362 \n **Description:** FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization. \n **CVSS Vector:** AV:N/AC:L/Au:N/C:P/I:P/A:P \n <details> <summary><b>CVSS Score:</b> 7.5 </summary> Exploitability score: 10.0 <br> Impact score: 6.4 </details> \n \n **Discovery Date:** 2019-05-30 \n **Vendors:**\n* debian  \n* oracle  \n* fasterxml \n \n **References:** \n * [[infra-devnull] 20190329 [GitHub] [pulsar] massakam opened pull request #3938: Upgrade third party libraries with security vulnerabilities](https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3E)  \n* [RHSA-2019:0877](https://access.redhat.com/errata/RHSA-2019:0877)  \n* [https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8](https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8)  \n* [[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1](https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E)  \n* [20190527 [SECURITY] [DSA 4452-1] jackson-databind security update](https://seclists.org/bugtraq/2019/May/68)  \n* [DSA-4452](https://www.debian.org/security/2019/dsa-4452)  \n* [https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html](https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html)  \n* [https://github.com/FasterXML/jackson-databind/issues/2186](https://github.com/FasterXML/jackson-databind/issues/2186)  \n* [[pulsar-commits] 20190329 [GitHub] [pulsar] massakam opened a new pull request #3938: Upgrade third party libraries with security vulnerabilities](https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E)  \n* [https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b](https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b)  \n* [RHSA-2019:0782](https://access.redhat.com/errata/RHSA-2019:0782)  \n* [https://issues.apache.org/jira/browse/TINKERPOP-2121](https://issues.apache.org/jira/browse/TINKERPOP-2121)  \n* [https://security.netapp.com/advisory/ntap-20190530-0003/](https://security.netapp.com/advisory/ntap-20190530-0003/)  \n* [[debian-lts-announce] 20190304 [SECURITY] [DLA 1703-1] jackson-databind security update](https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html)  \n* [RHBA-2019:0959](https://access.redhat.com/errata/RHBA-2019:0959)"}}
{"actor":{"display_login":"webhook-test26"}}