{"action":"opened","issue":{"url":"https://api.github.com/repos/TIBCOSoftware/justapis-javascript-sdk/issues/57","repository_url":"https://api.github.com/repos/TIBCOSoftware/justapis-javascript-sdk","labels_url":"https://api.github.com/repos/TIBCOSoftware/justapis-javascript-sdk/issues/57/labels{/name}","comments_url":"https://api.github.com/repos/TIBCOSoftware/justapis-javascript-sdk/issues/57/comments","events_url":"https://api.github.com/repos/TIBCOSoftware/justapis-javascript-sdk/issues/57/events","html_url":"https://github.com/TIBCOSoftware/justapis-javascript-sdk/issues/57","id":530833161,"node_id":"MDU6SXNzdWU1MzA4MzMxNjE=","number":57,"title":"WS-2019-0310 (Medium) detected in https-proxy-agent-2.2.1.tgz","user":{"login":"whitesource-for-github-com[bot]","id":50673670,"node_id":"MDM6Qm90NTA2NzM2NzA=","avatar_url":"https://avatars3.githubusercontent.com/in/30796?v=4","gravatar_id":"","url":"https://api.github.com/users/whitesource-for-github-com%5Bbot%5D","html_url":"https://github.com/apps/whitesource-for-github-com","followers_url":"https://api.github.com/users/whitesource-for-github-com%5Bbot%5D/followers","following_url":"https://api.github.com/users/whitesource-for-github-com%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/whitesource-for-github-com%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/whitesource-for-github-com%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whitesource-for-github-com%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/whitesource-for-github-com%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/whitesource-for-github-com%5Bbot%5D/repos","events_url":"https://api.github.com/users/whitesource-for-github-com%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/whitesource-for-github-com%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":1412435848,"node_id":"MDU6TGFiZWwxNDEyNDM1ODQ4","url":"https://api.github.com/repos/TIBCOSoftware/justapis-javascript-sdk/labels/security%20vulnerability","name":"security vulnerability","color":"d1260f","default":false,"description":"Security vulnerability detected by WhiteSource"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-12-02T01:07:06Z","updated_at":"2019-12-02T01:07:06Z","closed_at":null,"author_association":"NONE","body":"## WS-2019-0310 - Medium Severity Vulnerability\n<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20> Vulnerable Library - <b>https-proxy-agent-2.2.1.tgz</b></p></summary>\n\n<p>An HTTP(s) proxy `http.Agent` implementation for HTTPS</p>\n<p>Library home page: <a href=\"https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-2.2.1.tgz\">https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-2.2.1.tgz</a></p>\n<p>Path to dependency file: /justapis-javascript-sdk/package.json</p>\n<p>Path to vulnerable library: /tmp/git/justapis-javascript-sdk/node_modules/https-proxy-agent/package.json</p>\n<p>\n\nDependency Hierarchy:\n  - grunt-mochify-0.3.0.tgz (Root Library)\n    - mochify-2.19.0.tgz\n      - min-wd-2.12.0.tgz\n        - saucelabs-1.5.0.tgz\n          - :x: **https-proxy-agent-2.2.1.tgz** (Vulnerable Library)\n</p>\n</details>\n<p></p>\n<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png' width=19 height=20> Vulnerability Details</summary>\n<p>  \n  \nThere is a Machine-In-The-Middle vulnerability found in https-proxy-agent before 2.2.3. There is a failure of TLS enforcement on the socket. Attacker may intercept unencrypted communications.\n\n<p>Publish Date: 2019-12-01\n<p>URL: <a href=https://github.com/TooTallNate/node-https-proxy-agent/commit/36d8cf509f877fa44f4404fce57ebaf9410fe51b>WS-2019-0310</a></p>\n</p>\n</details>\n<p></p>\n<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20> CVSS 2 Score Details (<b>5.0</b>)</summary>\n<p>\n\nBase Score Metrics not available</p>\n\n</p>\n</details>\n<p></p>\n<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/suggested_fix.png' width=19 height=20> Suggested Fix</summary>\n<p>\n\n<p>Type: Upgrade version</p>\n<p>Origin: <a href=\"https://www.npmjs.com/advisories/1184\">https://www.npmjs.com/advisories/1184</a></p>\n<p>Release Date: 2019-12-01</p>\n<p>Fix Resolution: https-proxy-agent - 2.2.3</p>\n\n</p>\n</details>\n<p></p>\n\n<!-- <REMEDIATE>{\"isOpenPROnVulnerability\":false,\"isPackageBased\":true,\"isDefaultBranch\":true,\"packages\":[{\"packageType\":\"javascript/Node.js\",\"packageName\":\"https-proxy-agent\",\"packageVersion\":\"2.2.1\",\"isTransitiveDependency\":true,\"dependencyTree\":\"grunt-mochify:0.3.0;mochify:2.19.0;min-wd:2.12.0;saucelabs:1.5.0;https-proxy-agent:2.2.1\",\"isMinimumFixVersionAvailable\":true,\"minimumFixVersion\":\"https-proxy-agent - 2.2.3\"}],\"vulnerabilityIdentifier\":\"WS-2019-0310\",\"vulnerabilityDetails\":\"There is a Machine-In-The-Middle vulnerability found in https-proxy-agent before 2.2.3. There is a failure of TLS enforcement on the socket. Attacker may intercept unencrypted communications.\",\"vulnerabilityUrl\":\"https://github.com/TooTallNate/node-https-proxy-agent/commit/36d8cf509f877fa44f4404fce57ebaf9410fe51b\",\"cvss2Severity\":\"medium\",\"cvss2Score\":\"5.0\",\"extraData\":{}}</REMEDIATE> -->"}}
{"actor":{"display_login":"whitesource-for-github-com"}}