{"grype_matches":[{"artifact":{"id":"b05d4b148ac934a9","cpes":["cpe:2.3:a:zlib:zlib:1.2.11-r1:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.2.11-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.2.11-r1","language":"","licenses":["zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libz.so.1.2.11"},{"path":"/lib/libz.so.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-25032","versionConstraint":">= 1.2.2.2, < 1.2.12 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:zlib:zlib:1.2.11:*:*:*:*:*:*:*"],"package":{"name":"zlib","version":"1.2.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-25032","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-10-08","epss":0.51733,"percentile":0.98922}],"risk":36.64420833333333,"urls":["http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","http://www.openwall.com/lists/oss-security/2022/03/25/2","http://www.openwall.com/lists/oss-security/2022/03/26/1","https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf","https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531","https://github.com/madler/zlib/compare/v1.2.11...v1.2.12","https://github.com/madler/zlib/issues/605","https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html","https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html","https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/","https://security.gentoo.org/glsa/202210-42","https://security.netapp.com/advisory/ntap-20220526-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5111","https://www.openwall.com/lists/oss-security/2022/03/24/1","https://www.openwall.com/lists/oss-security/2022/03/28/1","https://www.openwall.com/lists/oss-security/2022/03/28/3","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-333517.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-565386.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-25032","description":"zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches."},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-1000517","versionConstraint":"< 1.29.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-1000517","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000517","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000517","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000517","date":"2026-10-08","epss":0.32919,"percentile":0.98321}],"risk":28.694395,"urls":["https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e","https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html","https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html","https://usn.ubuntu.com/3935-1/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000517","description":"BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e."},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-1000517","versionConstraint":"< 1.29.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-1000517","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000517","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000517","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000517","date":"2026-10-08","epss":0.32919,"percentile":0.98321}],"risk":28.694395,"urls":["https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e","https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html","https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html","https://usn.ubuntu.com/3935-1/"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000517","description":"BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e."},"relatedVulnerabilities":[]},{"artifact":{"id":"b05d4b148ac934a9","cpes":["cpe:2.3:a:zlib:zlib:1.2.11-r1:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.2.11-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.2.11-r1","language":"","licenses":["zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libz.so.1.2.11"},{"path":"/lib/libz.so.1"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:zlib:zlib:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-37434","versionConstraint":"<= 1.2.12 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:zlib:zlib:1.2.11:*:*:*:*:*:*:*"],"package":{"name":"zlib","version":"1.2.11-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-37434","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-10-08","epss":0.18972,"percentile":0.97237}],"risk":17.83368,"urls":["http://seclists.org/fulldisclosure/2022/Oct/37","http://seclists.org/fulldisclosure/2022/Oct/38","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/42","http://www.openwall.com/lists/oss-security/2022/08/05/2","http://www.openwall.com/lists/oss-security/2022/08/09/1","https://github.com/curl/curl/issues/9271","https://github.com/ivd38/zlib_overflow","https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063","https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d","https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1","https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764","https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/","https://security.netapp.com/advisory/ntap-20220901-0005/","https://security.netapp.com/advisory/ntap-20230427-0007/","https://support.apple.com/kb/HT213488","https://support.apple.com/kb/HT213489","https://support.apple.com/kb/HT213490","https://support.apple.com/kb/HT213491","https://support.apple.com/kb/HT213493","https://support.apple.com/kb/HT213494","https://www.debian.org/security/2022/dsa-5218","https://cert-portal.siemens.com/productcert/html/ssa-150063.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37434","description":"zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference)."},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-20679","versionConstraint":"< 1.30.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-20679","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20679","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-20679","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-20679","date":"2026-10-08","epss":0.07694,"percentile":0.94456}],"risk":5.449916666666667,"urls":["http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://seclists.org/fulldisclosure/2019/Sep/7","https://bugs.busybox.net/show_bug.cgi?id=11506","https://busybox.net/news.html","https://git.busybox.net/busybox/commit/?id=6d3b4bb24da9a07c263f3c1acf8df85382ff562c","https://seclists.org/bugtraq/2019/Sep/7","https://usn.ubuntu.com/3935-1/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20679","description":"An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes."},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2018-20679","versionConstraint":"< 1.30.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2018-20679","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20679","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-20679","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-20679","date":"2026-10-08","epss":0.07694,"percentile":0.94456}],"risk":5.449916666666667,"urls":["http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://seclists.org/fulldisclosure/2019/Sep/7","https://bugs.busybox.net/show_bug.cgi?id=11506","https://busybox.net/news.html","https://git.busybox.net/busybox/commit/?id=6d3b4bb24da9a07c263f3c1acf8df85382ff562c","https://seclists.org/bugtraq/2019/Sep/7","https://usn.ubuntu.com/3935-1/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20679","description":"An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP server, client, and relay) allows a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to verification in udhcp_get_option() in networking/udhcp/common.c that 4-byte options are indeed 4 bytes."},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-5747","versionConstraint":"<= 1.30.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-5747","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5747","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-5747","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-5747","date":"2026-10-08","epss":0.04651,"percentile":0.91497}],"risk":3.294458333333334,"urls":["http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://seclists.org/fulldisclosure/2019/Sep/7","https://bugs.busybox.net/show_bug.cgi?id=11506","https://git.busybox.net/busybox/commit/?id=74d9f1ba37010face4bd1449df4d60dd84450b06","https://seclists.org/bugtraq/2019/Sep/7","https://usn.ubuntu.com/3935-1/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5747","description":"An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679."},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2019-5747","versionConstraint":"<= 1.30.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2019-5747","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5747","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-5747","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-5747","date":"2026-10-08","epss":0.04651,"percentile":0.91497}],"risk":3.294458333333334,"urls":["http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://seclists.org/fulldisclosure/2019/Sep/7","https://bugs.busybox.net/show_bug.cgi?id=11506","https://git.busybox.net/busybox/commit/?id=74d9f1ba37010face4bd1449df4d60dd84450b06","https://seclists.org/bugtraq/2019/Sep/7","https://usn.ubuntu.com/3935-1/"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5747","description":"An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP client, server, and/or relay) might allow a remote attacker to leak sensitive information from the stack by sending a crafted DHCP message. This is related to assurance of a 4-byte length when decoding DHCP_SUBNET. NOTE: this issue exists because of an incomplete fix for CVE-2018-20679."},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-48174","versionConstraint":"<= 1.36.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-48174","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48174","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48174","date":"2026-10-08","epss":0.03158,"percentile":0.87589}],"risk":2.96852,"urls":["https://bugs.busybox.net/show_bug.cgi?id=15216","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html","https://security.netapp.com/advisory/ntap-20241129-0001/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48174","description":"There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-48174","versionConstraint":"<= 1.36.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-48174","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-48174","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-48174","date":"2026-10-08","epss":0.03158,"percentile":0.87589}],"risk":2.96852,"urls":["https://bugs.busybox.net/show_bug.cgi?id=15216","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html","https://security.netapp.com/advisory/ntap-20241129-0001/","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"Critical","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-48174","description":"There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution."},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-28391","versionConstraint":"<= 1.35.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-28391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-28391","cwe":"CWE-88","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-28391","date":"2026-10-08","epss":0.03521,"percentile":0.88907}],"risk":2.752248333333333,"urls":["https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch","https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch","https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-28391","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors."},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2022-28391","versionConstraint":"<= 1.35.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2022-28391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-28391","cwe":"CWE-88","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-28391","date":"2026-10-08","epss":0.03521,"percentile":0.88907}],"risk":2.752248333333333,"urls":["https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch","https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch","https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-28391","description":"BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alternatively, the attacker could choose to change the terminal's colors."},"relatedVulnerabilities":[]},{"artifact":{"id":"1660aa419e23e773","cpes":["cpe:2.3:a:musl-libc:musl:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl_libc:musl:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl:1.1.19-r10:*:*:*:*:*:*:*"],"name":"musl","purl":"pkg:apk/alpine/musl@1.1.19-r10?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.1.19-r10","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libc.musl-x86_64.so.1"},{"path":"/lib/ld-musl-x86_64.so.1"},{"path":"/usr"},{"path":"/usr/lib"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.19-r11"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-14697","versionConstraint":"< 1.1.19-r11 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.8.1"},"package":{"name":"musl","version":"1.1.19-r10"},"namespace":"alpine:distro:alpine:3.8"}},{"fix":{"suggestedVersion":"1.1.19-r11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-14697","versionConstraint":"< 1.1.19-r11 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.8.1"},"package":{"name":"musl","version":"1.1.19-r10"},"namespace":"alpine:distro:alpine:3.8"}}],"vulnerability":{"id":"CVE-2019-14697","fix":{"state":"fixed","versions":["1.1.19-r11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.19-r11"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14697","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14697","date":"2026-10-08","epss":0.02527,"percentile":0.84421}],"risk":2.3753800000000003,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.8","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2019-14697"},"relatedVulnerabilities":[{"id":"CVE-2019-14697","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14697","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14697","date":"2026-10-08","epss":0.02527,"percentile":0.84421}],"urls":["http://www.openwall.com/lists/oss-security/2019/08/06/4","https://security.gentoo.org/glsa/202003-13","https://www.openwall.com/lists/musl/2019/08/06/1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14697","description":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code."}]},{"artifact":{"id":"463f3304c5e7114c","cpes":["cpe:2.3:a:musl-utils:musl-utils:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl-utils:musl_utils:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl_utils:musl-utils:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl_utils:musl_utils:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl-utils:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl_utils:1.1.19-r10:*:*:*:*:*:*:*"],"name":"musl-utils","purl":"pkg:apk/alpine/musl-utils@1.1.19-r10?arch=x86_64&distro=alpine-3.8.1&upstream=musl","type":"apk","version":"1.1.19-r10","language":"","licenses":["BSD","GPL2+","MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/sbin"},{"path":"/sbin/ldconfig"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/iconv"},{"path":"/usr/bin/ldd"},{"path":"/usr/bin/getconf"},{"path":"/usr/bin/getent"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.19-r11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-14697","versionConstraint":"< 1.1.19-r11 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.8.1"},"package":{"name":"musl","version":"1.1.19-r10"},"namespace":"alpine:distro:alpine:3.8"}}],"vulnerability":{"id":"CVE-2019-14697","fix":{"state":"fixed","versions":["1.1.19-r11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.1.19-r11"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14697","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14697","date":"2026-10-08","epss":0.02527,"percentile":0.84421}],"risk":2.3753800000000003,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.8","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2019-14697"},"relatedVulnerabilities":[{"id":"CVE-2019-14697","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14697","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14697","date":"2026-10-08","epss":0.02527,"percentile":0.84421}],"urls":["http://www.openwall.com/lists/oss-security/2019/08/06/4","https://security.gentoo.org/glsa/202003-13","https://www.openwall.com/lists/musl/2019/08/06/1"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14697","description":"musl libc through 1.1.23 has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code."}]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42380","versionConstraint":">= 1.28.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42380","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42380","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42380","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42380","date":"2026-10-08","epss":0.03087,"percentile":0.87321}],"risk":2.23293,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42380","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function"},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42380","versionConstraint":">= 1.28.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42380","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42380","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42380","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42380","date":"2026-10-08","epss":0.03087,"percentile":0.87321}],"risk":2.23293,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42380","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function"},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42379","versionConstraint":">= 1.18.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42379","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42379","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42379","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42379","date":"2026-10-08","epss":0.02795,"percentile":0.86024}],"risk":2.0217166666666664,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42379","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function"},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42381","versionConstraint":">= 1.21.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42381","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42381","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42381","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42381","date":"2026-10-08","epss":0.02795,"percentile":0.86024}],"risk":2.0217166666666664,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42381","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function"},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42379","versionConstraint":">= 1.18.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42379","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42379","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42379","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42379","date":"2026-10-08","epss":0.02795,"percentile":0.86024}],"risk":2.0217166666666664,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42379","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the next_input_file function"},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42381","versionConstraint":">= 1.21.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42381","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42381","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42381","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42381","date":"2026-10-08","epss":0.02795,"percentile":0.86024}],"risk":2.0217166666666664,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42381","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function"},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42385","versionConstraint":">= 1.16.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42385","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42385","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42385","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42385","date":"2026-10-08","epss":0.02795,"percentile":0.86023}],"risk":2.0217166666666664,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42385","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function"},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42385","versionConstraint":">= 1.16.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42385","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42385","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42385","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42385","date":"2026-10-08","epss":0.02795,"percentile":0.86023}],"risk":2.0217166666666664,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42385","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function"},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42382","versionConstraint":">= 1.26.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42382","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42382","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42382","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42382","date":"2026-10-08","epss":0.02756,"percentile":0.85823}],"risk":1.9935066666666663,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42382","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function"},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42382","versionConstraint":">= 1.26.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42382","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42382","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42382","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42382","date":"2026-10-08","epss":0.02756,"percentile":0.85823}],"risk":1.9935066666666663,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42382","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function"},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42378","versionConstraint":">= 1.16.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42378","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42378","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42378","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42378","date":"2026-10-08","epss":0.02733,"percentile":0.85671}],"risk":1.97687,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42378","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function"},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42378","versionConstraint":">= 1.16.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42378","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42378","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42378","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42378","date":"2026-10-08","epss":0.02733,"percentile":0.85671}],"risk":1.97687,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42378","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_i function"},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42384","versionConstraint":">= 1.18.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42384","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42384","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42384","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42384","date":"2026-10-08","epss":0.02733,"percentile":0.8567}],"risk":1.97687,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42384","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function"},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42386","versionConstraint":">= 1.16.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42386","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42386","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42386","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42386","date":"2026-10-08","epss":0.02733,"percentile":0.8567}],"risk":1.97687,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42386","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function"},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42384","versionConstraint":">= 1.18.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42384","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42384","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42384","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42384","date":"2026-10-08","epss":0.02733,"percentile":0.8567}],"risk":1.97687,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42384","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function"},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42386","versionConstraint":">= 1.16.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42386","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42386","cwe":"CWE-416","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42386","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42386","date":"2026-10-08","epss":0.02733,"percentile":0.8567}],"risk":1.97687,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42386","description":"A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function"},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42374","versionConstraint":">= 1.27.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42374","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":3.3,"impactScore":5,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42374","cwe":"CWE-125","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42374","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42374","date":"2026-10-08","epss":0.00623,"percentile":0.48237}],"risk":0.30007833333333334,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42374","description":"An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that"},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42374","versionConstraint":">= 1.27.0, <= 1.33.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42374","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":3.3,"impactScore":5,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":4.3,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42374","cwe":"CWE-125","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42374","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42374","date":"2026-10-08","epss":0.00623,"percentile":0.48237}],"risk":0.30007833333333334,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/","https://lists.debian.org/debian-lts-announce/2025/01/msg00012.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42374","description":"An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be triggered by any applet/format that"},"relatedVulnerabilities":[]},{"artifact":{"id":"1660aa419e23e773","cpes":["cpe:2.3:a:musl-libc:musl:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl_libc:musl:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl:1.1.19-r10:*:*:*:*:*:*:*"],"name":"musl","purl":"pkg:apk/alpine/musl@1.1.19-r10?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.1.19-r10","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libc.musl-x86_64.so.1"},{"path":"/lib/ld-musl-x86_64.so.1"},{"path":"/usr"},{"path":"/usr/lib"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:musl-libc:musl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2020-28928","versionConstraint":"<= 1.2.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:musl-libc:musl:1.1.19:*:*:*:*:*:*:*"],"package":{"name":"musl","version":"1.1.19-r10"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2020-28928","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-28928","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-28928","date":"2026-10-08","epss":0.00652,"percentile":0.49681}],"risk":0.28687999999999997,"urls":["http://www.openwall.com/lists/oss-security/2020/11/20/4","https://lists.apache.org/thread.html/r2134abfe847bea7795f0e53756d10a47e6643f35ab8169df8b8a9eb1%40%3Cnotifications.apisix.apache.org%3E","https://lists.apache.org/thread.html/r90b60cf49348e515257b4950900c1bd3ab95a960cf2469d919c7264e%40%3Cnotifications.apisix.apache.org%3E","https://lists.apache.org/thread.html/ra63e8dc5137d952afc55dbbfa63be83304ecf842d1eab1ff3ebb29e2%40%3Cnotifications.apisix.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/11/msg00050.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKQ3RVSMVZNZNO4D65W2CZZ4DMYFZN2Q/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UW27QVY7ERPTSGKS4KAWE5TU7EJWHKVQ/","https://musl.libc.org/releases.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-28928","description":"In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstrated by an invalid write access (buffer overflow)."},"relatedVulnerabilities":[]},{"artifact":{"id":"1660aa419e23e773","cpes":["cpe:2.3:a:musl-libc:musl:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl_libc:musl:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl:1.1.19-r10:*:*:*:*:*:*:*"],"name":"musl","purl":"pkg:apk/alpine/musl@1.1.19-r10?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.1.19-r10","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libc.musl-x86_64.so.1"},{"path":"/lib/ld-musl-x86_64.so.1"},{"path":"/usr"},{"path":"/usr/lib"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:musl-libc:musl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-26519","versionConstraint":">= 0.9.13, < 1.2.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:musl-libc:musl:1.1.19:*:*:*:*:*:*:*"],"package":{"name":"musl","version":"1.1.19-r10"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-26519","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","metrics":{"baseScore":8.1,"impactScore":6,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-26519","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-26519","date":"2026-10-08","epss":0.00349,"percentile":0.2644}],"risk":0.2626225,"urls":["https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3da","https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659","https://www.openwall.com/lists/oss-security/2025/02/13/2","http://www.openwall.com/lists/oss-security/2025/02/13/2","http://www.openwall.com/lists/oss-security/2025/02/13/3","http://www.openwall.com/lists/oss-security/2025/02/13/4","http://www.openwall.com/lists/oss-security/2025/02/13/5","http://www.openwall.com/lists/oss-security/2025/02/14/5","http://www.openwall.com/lists/oss-security/2025/02/14/6"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-26519","description":"musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write vulnerability when an attacker can trigger iconv conversion of untrusted EUC-KR text to UTF-8."},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42376","versionConstraint":">= 1.16.0, < 1.34.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42376","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42376","cwe":"CWE-476","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42376","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42376","date":"2026-10-08","epss":0.00432,"percentile":0.35546}],"risk":0.18792,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42376","description":"A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input."},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2021-42376","versionConstraint":">= 1.16.0, < 1.34.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2021-42376","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":1.9,"impactScore":2.9,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42376","cwe":"CWE-476","type":"Secondary","source":"reefs@jfrog.com"},{"cve":"CVE-2021-42376","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42376","date":"2026-10-08","epss":0.00432,"percentile":0.35546}],"risk":0.18792,"urls":["https://claroty.com/team82/research/unboxing-busybox-14-vulnerabilities-uncovered-by-claroty-jfrog","https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/","https://security.netapp.com/advisory/ntap-20211223-0002/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42376","description":"A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \\x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input."},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"1660aa419e23e773","cpes":["cpe:2.3:a:musl-libc:musl:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl_libc:musl:1.1.19-r10:*:*:*:*:*:*:*","cpe:2.3:a:musl:musl:1.1.19-r10:*:*:*:*:*:*:*"],"name":"musl","purl":"pkg:apk/alpine/musl@1.1.19-r10?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.1.19-r10","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/lib"},{"path":"/lib/libc.musl-x86_64.so.1"},{"path":"/lib/ld-musl-x86_64.so.1"},{"path":"/usr"},{"path":"/usr/lib"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"musl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:musl-libc:musl:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-40200","versionConstraint":">= 0.7.10, <= 1.2.6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:musl-libc:musl:1.1.19:*:*:*:*:*:*:*"],"package":{"name":"musl","version":"1.1.19-r10"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-40200","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-40200","cwe":"CWE-670","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-40200","date":"2026-10-08","epss":0.00171,"percentile":0.05925}],"risk":0.13338,"urls":["https://musl.libc.org/releases.html","https://www.openwall.com/lists/oss-security/2026/04/10/13","http://www.openwall.com/lists/oss-security/2026/04/10/13"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-40200","description":"An issue was discovered in musl libc 0.7.10 through 1.2.6. Stack-based memory corruption can occur during qsort of very large arrays, due to incorrectly implemented double-word primitives. The number of elements must exceed about seven million, i.e., the 32nd Leonardo number on 32-bit platforms (or the 64th Leonardo number on 64-bit platforms, which is not practical)."},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-46394","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-46394","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":3.2,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-46394","cwe":"CWE-451","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-46394","date":"2026-10-08","epss":0.00183,"percentile":0.07182}],"risk":0.0571875,"urls":["https://bugs.busybox.net/show_bug.cgi?id=16018","https://www.busybox.net","https://www.busybox.net/downloads/","http://www.openwall.com/lists/oss-security/2025/04/23/5","http://www.openwall.com/lists/oss-security/2025/04/24/3","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-46394","description":"In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences."},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-46394","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-46394","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":3.2,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-46394","cwe":"CWE-451","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-46394","date":"2026-10-08","epss":0.00183,"percentile":0.07182}],"risk":0.0571875,"urls":["https://bugs.busybox.net/show_bug.cgi?id=16018","https://www.busybox.net","https://www.busybox.net/downloads/","http://www.openwall.com/lists/oss-security/2025/04/23/5","http://www.openwall.com/lists/oss-security/2025/04/24/3","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-46394","description":"In tar in BusyBox through 1.37.0, a TAR archive can have filenames hidden from a listing through the use of terminal escape sequences."},"relatedVulnerabilities":[]},{"artifact":{"id":"07e5437e05dd68b8","cpes":["cpe:2.3:a:busybox:busybox:1.28.4-r1:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/bin/sh"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/udhcpd.conf"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-down.d"},{"path":"/sbin"},{"path":"/tmp"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/bin"},{"path":"/var"},{"path":"/var/lib"},{"path":"/var/lib/udhcpd"},{"path":"/var/cache"},{"path":"/var/cache/misc"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-58251","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-58251","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-58251","cwe":"CWE-150","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-58251","date":"2026-10-08","epss":0.00178,"percentile":0.06734}],"risk":0.04895,"urls":["https://bugs.busybox.net/show_bug.cgi?id=15922","https://www.busybox.net","https://www.busybox.net/downloads/","http://www.openwall.com/lists/oss-security/2025/04/23/6"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-58251","description":"In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim."},"relatedVulnerabilities":[]},{"artifact":{"id":"c4c5ae2ff8411e10","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.28.4-r1:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.28.4-r1:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.28.4-r1?arch=x86_64&distro=alpine-3.8.1&upstream=busybox","type":"apk","version":"1.28.4-r1","language":"","licenses":["GPL-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:c54f8a17910a27d799d33dfd0997625eb72ea10682dd2c033732d0c775e0589e","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2024-58251","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.28.4:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.28.4-r1"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2024-58251","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-58251","cwe":"CWE-150","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-58251","date":"2026-10-08","epss":0.00178,"percentile":0.06734}],"risk":0.04895,"urls":["https://bugs.busybox.net/show_bug.cgi?id=15922","https://www.busybox.net","https://www.busybox.net/downloads/","http://www.openwall.com/lists/oss-security/2025/04/23/6"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-58251","description":"In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim."},"relatedVulnerabilities":[]}],"grade":"F","score":"0.00","as_of":"2026-10-10T06:02:14.221Z","grype_db_version":"2026-10-09T06:32:32.000Z"}