{"grype_matches":[{"artifact":{"id":"64fb403427048cc6","cpes":["cpe:2.3:a:org.springframework:spring-beans:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_beans:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-beans:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_beans:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-beans:spring-beans:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-beans:spring_beans:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_beans:spring-beans:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_beans:spring_beans:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-beans:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_beans:4.1.6.RELEASE:*:*:*:*:*:*:*"],"name":"spring-beans","purl":"pkg:maven/org.springframework/spring-beans@4.1.6.RELEASE","type":"java-archive","version":"4.1.6.RELEASE","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-beans-4.1.6.RELEASE.jar","manifestName":"","pomArtifactID":"spring-beans","archiveDigests":[{"value":"ce2d409d470948f11fad41ffdf37dcff4d28cd7c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-beans-4.1.6.RELEASE.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-beans-4.1.6.RELEASE.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.2.20.RELEASE"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-36p3-wjmg-h94x","versionConstraint":"<5.2.20.RELEASE (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-beans","version":"4.1.6.RELEASE"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-36p3-wjmg-h94x","fix":{"state":"fixed","versions":["5.2.20.RELEASE"],"available":[{"date":"2022-12-16","kind":"first-observed","version":"5.2.20.RELEASE"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22965","cwe":"CWE-94","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2022-22965","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22965","date":"2026-10-10","epss":0.99638,"percentile":0.99949}],"risk":98.70000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22965","https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15","https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12","https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6","https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE","https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18","https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","https://tanzu.vmware.com/security/cve-2022-22965","https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67","https://www.oracle.com/security-alerts/cpuapr2022.html","http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html","http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.kb.cert.org/vuls/id/970766","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","description":"Remote Code Execution in Spring Framework","knownExploited":[{"cve":"CVE-2022-22965","cwes":["CWE-94"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22965"],"dueDate":"2022-04-25","product":"Spring Framework","dateAdded":"2022-04-04","vendorProject":"VMware","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2022-22965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22965","cwe":"CWE-94","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2022-22965","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22965","date":"2026-10-10","epss":0.99638,"percentile":0.99949}],"urls":["http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html","http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html","https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005","https://tanzu.vmware.com/security/cve-2022-22965","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.kb.cert.org/vuls/id/970766","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22965","description":"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.","knownExploited":[{"cve":"CVE-2022-22965","cwes":["CWE-94"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22965"],"dueDate":"2022-04-25","product":"Spring Framework","dateAdded":"2022-04-04","vendorProject":"VMware","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"3eb92f7ec39e3872","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@2.5.6.SEC03","type":"java-archive","version":"2.5.6.SEC03","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:embedded-crowd-admin-plugin-1.8.4.jar:META-INF/lib/spring-webmvc-2.5.6.SEC03.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"275c5ac6ade12819f49e984c8e06b114a4e23458","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:embedded-crowd-admin-plugin-1.8.4.jar:META-INF/lib/spring-webmvc-2.5.6.SEC03.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.2.20.RELEASE"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-36p3-wjmg-h94x","versionConstraint":"<5.2.20.RELEASE (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"2.5.6.SEC03"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-36p3-wjmg-h94x","fix":{"state":"fixed","versions":["5.2.20.RELEASE"],"available":[{"date":"2022-12-16","kind":"first-observed","version":"5.2.20.RELEASE"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22965","cwe":"CWE-94","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2022-22965","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22965","date":"2026-10-10","epss":0.99638,"percentile":0.99949}],"risk":98.70000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22965","https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15","https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12","https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6","https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE","https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18","https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","https://tanzu.vmware.com/security/cve-2022-22965","https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67","https://www.oracle.com/security-alerts/cpuapr2022.html","http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html","http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.kb.cert.org/vuls/id/970766","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","description":"Remote Code Execution in Spring Framework","knownExploited":[{"cve":"CVE-2022-22965","cwes":["CWE-94"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22965"],"dueDate":"2022-04-25","product":"Spring Framework","dateAdded":"2022-04-04","vendorProject":"VMware","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2022-22965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22965","cwe":"CWE-94","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2022-22965","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22965","date":"2026-10-10","epss":0.99638,"percentile":0.99949}],"urls":["http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html","http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html","https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005","https://tanzu.vmware.com/security/cve-2022-22965","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.kb.cert.org/vuls/id/970766","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22965","description":"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.","knownExploited":[{"cve":"CVE-2022-22965","cwes":["CWE-94"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22965"],"dueDate":"2022-04-25","product":"Spring Framework","dateAdded":"2022-04-04","vendorProject":"VMware","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"38a684e8390fbe0f","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@4.1.6.RELEASE","type":"java-archive","version":"4.1.6.RELEASE","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-webmvc-4.1.6.RELEASE.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"e1ee19a5359f214d65cc18972df8aba17ce1e423","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-webmvc-4.1.6.RELEASE.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-webmvc-4.1.6.RELEASE.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.2.20.RELEASE"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-36p3-wjmg-h94x","versionConstraint":"<5.2.20.RELEASE (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"4.1.6.RELEASE"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-36p3-wjmg-h94x","fix":{"state":"fixed","versions":["5.2.20.RELEASE"],"available":[{"date":"2022-12-16","kind":"first-observed","version":"5.2.20.RELEASE"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22965","cwe":"CWE-94","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2022-22965","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22965","date":"2026-10-10","epss":0.99638,"percentile":0.99949}],"risk":98.70000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22965","https://github.com/spring-projects/spring-framework/commit/002546b3e4b8d791ea6acccb81eb3168f51abb15","https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12","https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6","https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE","https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18","https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement","https://tanzu.vmware.com/security/cve-2022-22965","https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67","https://www.oracle.com/security-alerts/cpuapr2022.html","http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html","http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.kb.cert.org/vuls/id/970766","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-36p3-wjmg-h94x","description":"Remote Code Execution in Spring Framework","knownExploited":[{"cve":"CVE-2022-22965","cwes":["CWE-94"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22965"],"dueDate":"2022-04-25","product":"Spring Framework","dateAdded":"2022-04-04","vendorProject":"VMware","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2022-22965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22965","cwe":"CWE-94","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2022-22965","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22965","date":"2026-10-10","epss":0.99638,"percentile":0.99949}],"urls":["http://packetstormsecurity.com/files/166713/Spring4Shell-Code-Execution.html","http://packetstormsecurity.com/files/167011/Spring4Shell-Spring-Framework-Class-Property-Remote-Code-Execution.html","https://cert-portal.siemens.com/productcert/pdf/ssa-254054.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005","https://tanzu.vmware.com/security/cve-2022-22965","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-rce-Zx9GUc67","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.kb.cert.org/vuls/id/970766","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22965"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22965","description":"A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.","knownExploited":[{"cve":"CVE-2022-22965","cwes":["CWE-94"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22965"],"dueDate":"2022-04-25","product":"Spring Framework","dateAdded":"2022-04-04","vendorProject":"VMware","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"bc2eeb61a61c87c0","cpes":["cpe:2.3:a:apache:commons-collections:3.2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_collections:3.2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:collections:3.2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:3.2.1:*:*:*:*:*:*:*"],"name":"commons-collections","purl":"pkg:maven/commons-collections/commons-collections@3.2.1","type":"java-archive","version":"3.2.1","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-collections","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-collections-3.2.1.jar","manifestName":"","pomArtifactID":"commons-collections","archiveDigests":[{"value":"761ea405b9b37ced573d2df0d1e3a4e0f9edc668","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-collections-3.2.1.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-collections-3.2.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fjq5-5j5f-mvxh","versionConstraint":"<3.2.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-collections:commons-collections","version":"3.2.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fjq5-5j5f-mvxh","fix":{"state":"fixed","versions":["3.2.2"],"available":[{"date":"2022-11-04","kind":"first-observed","version":"3.2.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-7501","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7501","date":"2026-10-10","epss":0.85562,"percentile":0.99719}],"risk":80.42828,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-7501","https://access.redhat.com/security/vulnerabilities/2059393","https://access.redhat.com/solutions/2045023","https://bugzilla.redhat.com/show_bug.cgi?id=1279330","http://rhn.redhat.com/errata/RHSA-2016-1773.html","https://commons.apache.org/proper/commons-collections/release_4_1.html","https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","https://issues.apache.org/jira/browse/COLLECTIONS-580.","https://arxiv.org/pdf/2306.05534.pdf","https://github.com/jensdietrich/xshady-release/tree/main/CVE-2015-7501","https://sourceforge.net/p/collections/code/HEAD/tree/"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fjq5-5j5f-mvxh","description":"Deserialization of Untrusted Data in Apache commons collections"},"relatedVulnerabilities":[{"id":"CVE-2015-7501","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-7501","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7501","date":"2026-10-10","epss":0.85562,"percentile":0.99719}],"urls":["http://rhn.redhat.com/errata/RHSA-2015-2500.html","http://rhn.redhat.com/errata/RHSA-2015-2501.html","http://rhn.redhat.com/errata/RHSA-2015-2502.html","http://rhn.redhat.com/errata/RHSA-2015-2514.html","http://rhn.redhat.com/errata/RHSA-2015-2516.html","http://rhn.redhat.com/errata/RHSA-2015-2517.html","http://rhn.redhat.com/errata/RHSA-2015-2521.html","http://rhn.redhat.com/errata/RHSA-2015-2522.html","http://rhn.redhat.com/errata/RHSA-2015-2524.html","http://rhn.redhat.com/errata/RHSA-2015-2670.html","http://rhn.redhat.com/errata/RHSA-2015-2671.html","http://rhn.redhat.com/errata/RHSA-2016-0040.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/78215","http://www.securitytracker.com/id/1034097","http://www.securitytracker.com/id/1037052","http://www.securitytracker.com/id/1037053","http://www.securitytracker.com/id/1037640","https://access.redhat.com/security/vulnerabilities/2059393","https://access.redhat.com/solutions/2045023","https://bugzilla.redhat.com/show_bug.cgi?id=1279330","https://rhn.redhat.com/errata/RHSA-2015-2536.html","https://security.netapp.com/advisory/ntap-20240216-0010/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-7501","description":"Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library."}]},{"artifact":{"id":"002ac568eb8b9e86","cpes":["cpe:2.3:a:apache:commons-beanutils:1.9.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_beanutils:1.9.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:beanutils:1.9.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9.2:*:*:*:*:*:*:*"],"name":"commons-beanutils","purl":"pkg:maven/commons-beanutils/commons-beanutils@1.9.2","type":"java-archive","version":"1.9.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-beanutils","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-beanutils-1.9.2.jar","manifestName":"","pomArtifactID":"commons-beanutils","archiveDigests":[{"value":"7a87d845ad3a155297e8f67d9008f4c1e5656b71","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-beanutils-1.9.2.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-beanutils-1.9.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.9.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p66x-2cv9-qq3v","versionConstraint":">=1.8.0,<1.9.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-beanutils:commons-beanutils","version":"1.9.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p66x-2cv9-qq3v","fix":{"state":"fixed","versions":["1.9.4"],"available":[{"date":"2024-06-06","kind":"first-observed","version":"1.9.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-0114","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0114","date":"2026-10-10","epss":0.99032,"percentile":0.9993}],"risk":74.274,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2014-0114","https://access.redhat.com/errata/RHSA-2018:2669","https://access.redhat.com/errata/RHSA-2019:2995","https://access.redhat.com/solutions/869353","https://bugzilla.redhat.com/show_bug.cgi?id=1091938","https://bugzilla.redhat.com/show_bug.cgi?id=1116665","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755","https://issues.apache.org/jira/browse/BEANUTILS-463","https://lists.apache.org/thread.html/0340493a1ddf3660dee09a5c503449cdac5bec48cdc478de65858859@%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/080af531a9113e29d3f6a060e3f992dc9f40315ec7234e15c3b339e3@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/084ae814e69178d2ce174cfdf149bc6e46d7524f3308c08d3adb43cb@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/098e9aae118ac5c06998a9ba4544ab2475162981d290fdef88e6f883@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/09981ae3df188a2ad1ce20f62ef76a5b2d27cf6b9ebab366cf1d6cc6@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/0a35108a56e2d575e3b3985588794e39fbf264097aba66f4c5569e4f@%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/0efed939139f5b9dcd62b8acf7cb8a9789227d14abdc0c6f141c4a4c@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/1565e8b786dff4cb3b48ecc8381222c462c92076c9e41408158797b5@%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/15fcdf27fa060de276edc0b4098526afc21c236852eb3de9be9594f3@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/2454e058fd05ba30ca29442fdeb7ea47505d47a888fbc9f3a53f31d0@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/2ba22f2e3de945039db735cf6cbf7f8be901ab2537337c7b1dd6a0f0@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/31f9dc2c9cb68e390634a4202f84b8569f64b6569bfcce46348fd9fd@%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3E","https://lists.apache.org/thread.html/3f500972dceb48e3cb351f58565aecf6728b1ea7a69593af86c30b30@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/40fc236a35801a535cd49cf1979dbeab034b833c63a284941bce5bf1@%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/42ad6326d62ea8453d0d0ce12eff39bbb7c5b4fca9639da007291346@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/4c3fd707a049bfe0577dba8fc9c4868ffcdabe68ad86586a0a49242e@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/65b39fa6d700e511927e5668a4038127432178a210aff81500eb36e5@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/66176fa3caeca77058d9f5b0316419a43b4c3fa2b572e05b87132226@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/6afe2f935493e69a332b9c5a4f23cafe95c15ede1591a492cf612293@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/6b30629b32d020c40d537f00b004d281c37528d471de15ca8aec2cd4@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/869c08899f34c1a70c9fb42f92ac0d043c98781317e0c19d7ba3f5e3@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/88c497eead24ed517a2bb3159d3dc48725c215e97fe7a98b2cf3ea25@%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/8e2bdfabd5b14836aa3cf900aa0a62ff9f4e22a518bb4e553ebcf55f@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/918ec15a80fc766ff46c5d769cb8efc88fed6674faadd61a7105166b@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/97fc033dad4233a5d82fcb75521eabdd23dd99ef32eb96f407f96a1a@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/9b5505632f5683ee17bda4f7878525e672226c7807d57709283ffa64@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/aa4ca069c7aea5b1d7329bc21576c44a39bcc4eb7bb2760c4b16f2f6@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/c24c0b931632a397142882ba248b7bd440027960f22845c6f664c639@%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/c7e31c3c90b292e0bafccc4e1b19c9afc1503a65d82cb7833dfd7478@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/cee6b1c4533be1a753614f6a7d7c533c42091e7cafd7053b8f62792a@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/d27c51b3c933f885460aa6d3004eb228916615caaaddbb8e8bfeeb40@%3Cgitbox.activemq.apache.org%3E","https://lists.apache.org/thread.html/df093c662b5e49fe9e38ef91f78ffab09d0839dea7df69a747dffa86@%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/df1c385f2112edffeff57a6b21d12e8d24031a9f578cb8ba22a947a8@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/ebc4f019798f6ce2a39f3e0c26a9068563a9ba092cdf3ece398d4e2f@%3Cnotifications.commons.apache.org%3E","https://lists.apache.org/thread.html/f3682772e62926b5c009eed63c62767021be6da0bb7427610751809f@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/fda473f46e51019a78ab217a7a3a3d48dafd90846e75bd5536ef72f3@%3Cnotifications.commons.apache.org%3E","https://lists.apache.org/thread.html/ffde3f266d3bde190b54c9202169e7918a92de7e7e0337d792dc7263@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/r75d67108e557bb5d4c4318435067714a0180de525314b7e8dab9d04e@%3Cissues.activemq.apache.org%3E","https://security.gentoo.org/glsa/201607-09","https://snyk.io/vuln/SNYK-JAVA-COMMONSBEANUTILS-30077","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://advisories.mageia.org/MGASA-2014-0219.html","http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2014-0114-Apache-Ignite-is-vulnerable-to-existing-CVE-2014-0114-td31205.html","http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt","http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136958.html","http://marc.info/?l=bugtraq&m=140119284401582&w=2","http://marc.info/?l=bugtraq&m=140801096002766&w=2","http://marc.info/?l=bugtraq&m=141451023707502&w=2","http://openwall.com/lists/oss-security/2014/06/15/10","http://openwall.com/lists/oss-security/2014/07/08/1","http://seclists.org/fulldisclosure/2014/Dec/23","http://www-01.ibm.com/support/docview.wss?uid=swg21674128","http://www-01.ibm.com/support/docview.wss?uid=swg21674812","http://www-01.ibm.com/support/docview.wss?uid=swg21675266","http://www-01.ibm.com/support/docview.wss?uid=swg21675387","http://www-01.ibm.com/support/docview.wss?uid=swg21675689","http://www-01.ibm.com/support/docview.wss?uid=swg21675898","http://www-01.ibm.com/support/docview.wss?uid=swg21675972","http://www-01.ibm.com/support/docview.wss?uid=swg21676091","http://www-01.ibm.com/support/docview.wss?uid=swg21676110","http://www-01.ibm.com/support/docview.wss?uid=swg21676303","http://www-01.ibm.com/support/docview.wss?uid=swg21676375","http://www-01.ibm.com/support/docview.wss?uid=swg21676931","http://www-01.ibm.com/support/docview.wss?uid=swg21677110","http://www-01.ibm.com/support/docview.wss?uid=swg27042296","http://www.debian.org/security/2014/dsa-2940","http://www.ibm.com/support/docview.wss?uid=swg21675496","http://www.mandriva.com/security/advisories?name=MDVSA-2014:095","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html","http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html","http://www.vmware.com/security/advisories/VMSA-2014-0008.html","http://www.vmware.com/security/advisories/VMSA-2014-0012.html","https://lists.apache.org/thread.html/0340493a1ddf3660dee09a5c503449cdac5bec48cdc478de65858859%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/080af531a9113e29d3f6a060e3f992dc9f40315ec7234e15c3b339e3%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/084ae814e69178d2ce174cfdf149bc6e46d7524f3308c08d3adb43cb%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/098e9aae118ac5c06998a9ba4544ab2475162981d290fdef88e6f883%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/09981ae3df188a2ad1ce20f62ef76a5b2d27cf6b9ebab366cf1d6cc6%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/0a35108a56e2d575e3b3985588794e39fbf264097aba66f4c5569e4f%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/0efed939139f5b9dcd62b8acf7cb8a9789227d14abdc0c6f141c4a4c%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/1565e8b786dff4cb3b48ecc8381222c462c92076c9e41408158797b5%40%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/15fcdf27fa060de276edc0b4098526afc21c236852eb3de9be9594f3%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/2454e058fd05ba30ca29442fdeb7ea47505d47a888fbc9f3a53f31d0%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/2ba22f2e3de945039db735cf6cbf7f8be901ab2537337c7b1dd6a0f0%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/31f9dc2c9cb68e390634a4202f84b8569f64b6569bfcce46348fd9fd%40%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E","https://lists.apache.org/thread.html/3f500972dceb48e3cb351f58565aecf6728b1ea7a69593af86c30b30%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/40fc236a35801a535cd49cf1979dbeab034b833c63a284941bce5bf1%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/42ad6326d62ea8453d0d0ce12eff39bbb7c5b4fca9639da007291346%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/4c3fd707a049bfe0577dba8fc9c4868ffcdabe68ad86586a0a49242e%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/65b39fa6d700e511927e5668a4038127432178a210aff81500eb36e5%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/66176fa3caeca77058d9f5b0316419a43b4c3fa2b572e05b87132226%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/6afe2f935493e69a332b9c5a4f23cafe95c15ede1591a492cf612293%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/6b30629b32d020c40d537f00b004d281c37528d471de15ca8aec2cd4%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/869c08899f34c1a70c9fb42f92ac0d043c98781317e0c19d7ba3f5e3%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/88c497eead24ed517a2bb3159d3dc48725c215e97fe7a98b2cf3ea25%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/8e2bdfabd5b14836aa3cf900aa0a62ff9f4e22a518bb4e553ebcf55f%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/918ec15a80fc766ff46c5d769cb8efc88fed6674faadd61a7105166b%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/97fc033dad4233a5d82fcb75521eabdd23dd99ef32eb96f407f96a1a%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/9b5505632f5683ee17bda4f7878525e672226c7807d57709283ffa64%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/aa4ca069c7aea5b1d7329bc21576c44a39bcc4eb7bb2760c4b16f2f6%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/c24c0b931632a397142882ba248b7bd440027960f22845c6f664c639%40%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/c7e31c3c90b292e0bafccc4e1b19c9afc1503a65d82cb7833dfd7478%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/cee6b1c4533be1a753614f6a7d7c533c42091e7cafd7053b8f62792a%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/d27c51b3c933f885460aa6d3004eb228916615caaaddbb8e8bfeeb40%40%3Cgitbox.activemq.apache.org%3E","https://lists.apache.org/thread.html/df093c662b5e49fe9e38ef91f78ffab09d0839dea7df69a747dffa86%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/df1c385f2112edffeff57a6b21d12e8d24031a9f578cb8ba22a947a8%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/ebc4f019798f6ce2a39f3e0c26a9068563a9ba092cdf3ece398d4e2f%40%3Cnotifications.commons.apache.org%3E","https://lists.apache.org/thread.html/f3682772e62926b5c009eed63c62767021be6da0bb7427610751809f%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/fda473f46e51019a78ab217a7a3a3d48dafd90846e75bd5536ef72f3%40%3Cnotifications.commons.apache.org%3E","https://lists.apache.org/thread.html/ffde3f266d3bde190b54c9202169e7918a92de7e7e0337d792dc7263%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/r458d61eaeadecaad04382ebe583230bc027f48d9e85e4731bc573477%40%3Ccommits.dolphinscheduler.apache.org%3E","https://lists.apache.org/thread.html/r75d67108e557bb5d4c4318435067714a0180de525314b7e8dab9d04e%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55%40%3Csolr-user.lucene.apache.org%3E","https://web.archive.org/web/20140618110851/http://www.securityfocus.com/bid/67121","https://web.archive.org/web/20150710065242/http://www.securityfocus.com/archive/1/534161/100/0/threaded","https://github.com/apache/commons-beanutils/pull/7","https://github.com/apache/commons-beanutils/commit/62e82ad92cf4818709d6044aaf257b73d42659a4","https://security.netapp.com/advisory/ntap-20180629-0006","https://security.netapp.com/advisory/ntap-20140911-0001"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p66x-2cv9-qq3v","description":"Arbitrary code execution in Apache Commons BeanUtils"},"relatedVulnerabilities":[{"id":"CVE-2014-0114","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-0114","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0114","date":"2026-10-10","epss":0.99032,"percentile":0.9993}],"urls":["http://advisories.mageia.org/MGASA-2014-0219.html","http://apache-ignite-developers.2346864.n4.nabble.com/CVE-2014-0114-Apache-Ignite-is-vulnerable-to-existing-CVE-2014-0114-td31205.html","http://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.2/RELEASE-NOTES.txt","http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136958.html","http://marc.info/?l=bugtraq&m=140119284401582&w=2","http://marc.info/?l=bugtraq&m=140801096002766&w=2","http://marc.info/?l=bugtraq&m=141451023707502&w=2","http://openwall.com/lists/oss-security/2014/06/15/10","http://openwall.com/lists/oss-security/2014/07/08/1","http://seclists.org/fulldisclosure/2014/Dec/23","http://secunia.com/advisories/57477","http://secunia.com/advisories/58710","http://secunia.com/advisories/58851","http://secunia.com/advisories/58947","http://secunia.com/advisories/59014","http://secunia.com/advisories/59118","http://secunia.com/advisories/59228","http://secunia.com/advisories/59245","http://secunia.com/advisories/59246","http://secunia.com/advisories/59430","http://secunia.com/advisories/59464","http://secunia.com/advisories/59479","http://secunia.com/advisories/59480","http://secunia.com/advisories/59704","http://secunia.com/advisories/59718","http://secunia.com/advisories/60177","http://secunia.com/advisories/60703","http://www-01.ibm.com/support/docview.wss?uid=swg21674128","http://www-01.ibm.com/support/docview.wss?uid=swg21674812","http://www-01.ibm.com/support/docview.wss?uid=swg21675266","http://www-01.ibm.com/support/docview.wss?uid=swg21675387","http://www-01.ibm.com/support/docview.wss?uid=swg21675689","http://www-01.ibm.com/support/docview.wss?uid=swg21675898","http://www-01.ibm.com/support/docview.wss?uid=swg21675972","http://www-01.ibm.com/support/docview.wss?uid=swg21676091","http://www-01.ibm.com/support/docview.wss?uid=swg21676110","http://www-01.ibm.com/support/docview.wss?uid=swg21676303","http://www-01.ibm.com/support/docview.wss?uid=swg21676375","http://www-01.ibm.com/support/docview.wss?uid=swg21676931","http://www-01.ibm.com/support/docview.wss?uid=swg21677110","http://www-01.ibm.com/support/docview.wss?uid=swg27042296","http://www.debian.org/security/2014/dsa-2940","http://www.ibm.com/support/docview.wss?uid=swg21675496","http://www.mandriva.com/security/advisories?name=MDVSA-2014:095","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html","http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html","http://www.securityfocus.com/archive/1/534161/100/0/threaded","http://www.securityfocus.com/bid/67121","http://www.vmware.com/security/advisories/VMSA-2014-0008.html","http://www.vmware.com/security/advisories/VMSA-2014-0012.html","https://access.redhat.com/errata/RHSA-2018:2669","https://access.redhat.com/errata/RHSA-2019:2995","https://access.redhat.com/solutions/869353","https://bugzilla.redhat.com/show_bug.cgi?id=1091938","https://bugzilla.redhat.com/show_bug.cgi?id=1116665","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755","https://issues.apache.org/jira/browse/BEANUTILS-463","https://lists.apache.org/thread.html/0340493a1ddf3660dee09a5c503449cdac5bec48cdc478de65858859%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/080af531a9113e29d3f6a060e3f992dc9f40315ec7234e15c3b339e3%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/084ae814e69178d2ce174cfdf149bc6e46d7524f3308c08d3adb43cb%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/098e9aae118ac5c06998a9ba4544ab2475162981d290fdef88e6f883%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/09981ae3df188a2ad1ce20f62ef76a5b2d27cf6b9ebab366cf1d6cc6%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/0a35108a56e2d575e3b3985588794e39fbf264097aba66f4c5569e4f%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/0efed939139f5b9dcd62b8acf7cb8a9789227d14abdc0c6f141c4a4c%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/1565e8b786dff4cb3b48ecc8381222c462c92076c9e41408158797b5%40%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/15fcdf27fa060de276edc0b4098526afc21c236852eb3de9be9594f3%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/2454e058fd05ba30ca29442fdeb7ea47505d47a888fbc9f3a53f31d0%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/2ba22f2e3de945039db735cf6cbf7f8be901ab2537337c7b1dd6a0f0%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/31f9dc2c9cb68e390634a4202f84b8569f64b6569bfcce46348fd9fd%40%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E","https://lists.apache.org/thread.html/3f500972dceb48e3cb351f58565aecf6728b1ea7a69593af86c30b30%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/40fc236a35801a535cd49cf1979dbeab034b833c63a284941bce5bf1%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/42ad6326d62ea8453d0d0ce12eff39bbb7c5b4fca9639da007291346%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/4c3fd707a049bfe0577dba8fc9c4868ffcdabe68ad86586a0a49242e%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/65b39fa6d700e511927e5668a4038127432178a210aff81500eb36e5%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/66176fa3caeca77058d9f5b0316419a43b4c3fa2b572e05b87132226%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/6afe2f935493e69a332b9c5a4f23cafe95c15ede1591a492cf612293%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/6b30629b32d020c40d537f00b004d281c37528d471de15ca8aec2cd4%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/869c08899f34c1a70c9fb42f92ac0d043c98781317e0c19d7ba3f5e3%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/88c497eead24ed517a2bb3159d3dc48725c215e97fe7a98b2cf3ea25%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/8e2bdfabd5b14836aa3cf900aa0a62ff9f4e22a518bb4e553ebcf55f%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/918ec15a80fc766ff46c5d769cb8efc88fed6674faadd61a7105166b%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/97fc033dad4233a5d82fcb75521eabdd23dd99ef32eb96f407f96a1a%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/9b5505632f5683ee17bda4f7878525e672226c7807d57709283ffa64%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/aa4ca069c7aea5b1d7329bc21576c44a39bcc4eb7bb2760c4b16f2f6%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/c24c0b931632a397142882ba248b7bd440027960f22845c6f664c639%40%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/c7e31c3c90b292e0bafccc4e1b19c9afc1503a65d82cb7833dfd7478%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/cee6b1c4533be1a753614f6a7d7c533c42091e7cafd7053b8f62792a%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/d27c51b3c933f885460aa6d3004eb228916615caaaddbb8e8bfeeb40%40%3Cgitbox.activemq.apache.org%3E","https://lists.apache.org/thread.html/df093c662b5e49fe9e38ef91f78ffab09d0839dea7df69a747dffa86%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/df1c385f2112edffeff57a6b21d12e8d24031a9f578cb8ba22a947a8%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/ebc4f019798f6ce2a39f3e0c26a9068563a9ba092cdf3ece398d4e2f%40%3Cnotifications.commons.apache.org%3E","https://lists.apache.org/thread.html/f3682772e62926b5c009eed63c62767021be6da0bb7427610751809f%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/fda473f46e51019a78ab217a7a3a3d48dafd90846e75bd5536ef72f3%40%3Cnotifications.commons.apache.org%3E","https://lists.apache.org/thread.html/ffde3f266d3bde190b54c9202169e7918a92de7e7e0337d792dc7263%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/r458d61eaeadecaad04382ebe583230bc027f48d9e85e4731bc573477%40%3Ccommits.dolphinscheduler.apache.org%3E","https://lists.apache.org/thread.html/r75d67108e557bb5d4c4318435067714a0180de525314b7e8dab9d04e%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55%40%3Csolr-user.lucene.apache.org%3E","https://security.gentoo.org/glsa/201607-09","https://security.netapp.com/advisory/ntap-20140911-0001/","https://security.netapp.com/advisory/ntap-20180629-0006/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-0114","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1."}]},{"artifact":{"id":"1b0f8262f0bac2cd","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-17456","versionConstraint":"< 1:2.1.4-2.1+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-17456","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-17456","cwe":"CWE-88","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-17456","date":"2026-10-10","epss":0.97356,"percentile":0.99898}],"risk":73.017,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-17456"},"relatedVulnerabilities":[{"id":"CVE-2018-17456","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-17456","cwe":"CWE-88","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-17456","date":"2026-10-10","epss":0.97356,"percentile":0.99898}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html","http://www.securityfocus.com/bid/105523","http://www.securityfocus.com/bid/107511","http://www.securitytracker.com/id/1041811","https://access.redhat.com/errata/RHSA-2018:3408","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2018:3541","https://access.redhat.com/errata/RHSA-2020:0316","https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404","https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46","https://marc.info/?l=git&m=153875888916397&w=2","https://seclists.org/bugtraq/2019/Mar/30","https://usn.ubuntu.com/3791-1/","https://www.debian.org/security/2018/dsa-4311","https://www.exploit-db.com/exploits/45548/","https://www.exploit-db.com/exploits/45631/","https://www.openwall.com/lists/oss-security/2018/10/06/3"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-17456","description":"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \"git clone\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character."}]},{"artifact":{"id":"c887d301ab2f172c","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u2?arch=all&distro=debian-8.5&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-17456","versionConstraint":"< 1:2.1.4-2.1+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-17456","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-17456","cwe":"CWE-88","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-17456","date":"2026-10-10","epss":0.97356,"percentile":0.99898}],"risk":73.017,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-17456"},"relatedVulnerabilities":[{"id":"CVE-2018-17456","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-17456","cwe":"CWE-88","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-17456","date":"2026-10-10","epss":0.97356,"percentile":0.99898}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html","http://www.securityfocus.com/bid/105523","http://www.securityfocus.com/bid/107511","http://www.securitytracker.com/id/1041811","https://access.redhat.com/errata/RHSA-2018:3408","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2018:3541","https://access.redhat.com/errata/RHSA-2020:0316","https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404","https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46","https://marc.info/?l=git&m=153875888916397&w=2","https://seclists.org/bugtraq/2019/Mar/30","https://usn.ubuntu.com/3791-1/","https://www.debian.org/security/2018/dsa-4311","https://www.exploit-db.com/exploits/45548/","https://www.exploit-db.com/exploits/45631/","https://www.openwall.com/lists/oss-security/2018/10/06/3"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-17456","description":"Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \"git clone\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character."}]},{"artifact":{"id":"f98489f676b41ccd","cpes":["cpe:2.3:a:apache:log4j:1.2.17:*:*:*:*:*:*:*"],"name":"log4j","purl":"pkg:maven/log4j/log4j@1.2.17","type":"java-archive","version":"1.2.17","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"log4j","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:log4j:log4j","manifestName":"","pomArtifactID":"log4j","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2qrg-x229-3v8q","versionConstraint":">=1.2,<=1.2.17 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"log4j:log4j","version":"1.2.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2qrg-x229-3v8q","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17571","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2019-17571","cwe":"CWE-502","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17571","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-17571","date":"2026-10-10","epss":0.6906,"percentile":0.9934}],"risk":64.91640000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-17571","https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1@%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c@%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E","https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6@%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d@%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8@%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1@%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5@%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60@%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7@%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26@%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f@%3Cdev.tika.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html","https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e@%3Cuser.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad@%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e@%3Clog4j-user.logging.apache.org%3E","https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2@%3Cdev.jena.apache.org%3E","https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2@%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f@%3Ccommits.zookeeper.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.debian.org/security/2020/dsa-4686","https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a@%3Cjira.kafka.apache.org%3E","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d@%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47@%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3@%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad@%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd@%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd@%3Cdev.kafka.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328@%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882@%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94@%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc@%3Ccommits.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc@%3Cissues.bookkeeper.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc%40%3Ccommits.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d%40%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94%40%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2%40%3Cdev.jena.apache.org%3E","https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc%40%3Cissues.bookkeeper.apache.org%3E","https://security.netapp.com/advisory/ntap-20200110-0001","https://usn.ubuntu.com/4495-1","https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47%40%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e%40%3Cuser.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e%40%3Clog4j-user.logging.apache.org%3E","https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179%40%3Cjira.kafka.apache.org%3E"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2qrg-x229-3v8q","description":"Deserialization of Untrusted Data in Log4j"},"relatedVulnerabilities":[{"id":"CVE-2019-17571","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17571","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2019-17571","cwe":"CWE-502","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17571","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-17571","date":"2026-10-10","epss":0.6906,"percentile":0.9934}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html","https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E","https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e%40%3Cuser.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r594411f4bddebaf48a4c70266d0b7849e0d82bb72826f61b3a35bba7%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e%40%3Clog4j-user.logging.apache.org%3E","https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r6d34da5a0ca17ab08179a30c971446c7421af0e96f6d60867eabfc52%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r8418a0dff1729f19cf1024937e23a2db4c0f94f2794a423f5c10e8e7%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2%40%3Cdev.jena.apache.org%3E","https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r90c23eb8c82835fa82df85ae5e88c81fd9241e20a22971b0fb8f2c34%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E","https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/ra18a903f785aed9403aea38bc6f36844a056283c00dcfc6936b6318c%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra9611a8431cb62369bce8909d7645597e1dd45c24b448836b1e54940%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rb3c94619728c8f8c176d8e175e0a1086ca737ecdfcd5a2214bb768bc%40%3Ccommits.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d%40%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rcd71280585425dad7e232f239c5709e425efdd0d3de4a92f808a4767%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47%40%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rdb7ddf28807e27c7801f6e56a0dfb31092d34c61bdd4fa2de9182119%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94%40%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apache.org%3E","https://lists.apache.org/thread.html/rf53eeefb7e7e524deaacb9f8671cbf01b8a253e865fb94e7656722c0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/rfdf65fa675c64a64459817344e0e6c44d51ee264beea6e5851fb60dc%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html","https://security.netapp.com/advisory/ntap-20200110-0001/","https://usn.ubuntu.com/4495-1/","https://www.debian.org/security/2020/dsa-4686","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17571","description":"Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17."}]},{"artifact":{"id":"f98489f676b41ccd","cpes":["cpe:2.3:a:apache:log4j:1.2.17:*:*:*:*:*:*:*"],"name":"log4j","purl":"pkg:maven/log4j/log4j@1.2.17","type":"java-archive","version":"1.2.17","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"log4j","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:log4j:log4j","manifestName":"","pomArtifactID":"log4j","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-65fg-84f6-3jq3","versionConstraint":"<=1.2.17 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"log4j:log4j","version":"1.2.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-65fg-84f6-3jq3","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23305","cwe":"CWE-89","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-23305","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23305","date":"2026-10-10","epss":0.66537,"percentile":0.99272}],"risk":62.54478000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-23305","https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y","https://logging.apache.org/log4j/1.2/index.html","http://www.openwall.com/lists/oss-security/2022/01/18/4","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.netapp.com/advisory/ntap-20220217-0007"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-65fg-84f6-3jq3","description":"SQL Injection in Log4j 1.2.x"},"relatedVulnerabilities":[{"id":"CVE-2022-23305","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23305","cwe":"CWE-89","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-23305","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23305","date":"2026-10-10","epss":0.66537,"percentile":0.99272}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/18/4","https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y","https://logging.apache.org/log4j/1.2/index.html","https://security.netapp.com/advisory/ntap-20220217-0007/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23305","description":"By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions."}]},{"artifact":{"id":"2e6c6b1814bce735","cpes":["cpe:2.3:a:apache-software-foundation:xalan:2.7.2:*:*:*:*:*:*:*","cpe:2.3:a:apache_software_foundation:xalan:2.7.2:*:*:*:*:*:*:*","cpe:2.3:a:sun-microsystems-inc-:xalan:2.7.2:*:*:*:*:*:*:*","cpe:2.3:a:sun_microsystems_inc_:xalan:2.7.2:*:*:*:*:*:*:*","cpe:2.3:a:princeton-university:xalan:2.7.2:*:*:*:*:*:*:*","cpe:2.3:a:princeton_university:xalan:2.7.2:*:*:*:*:*:*:*","cpe:2.3:a:markus-dahm:xalan:2.7.2:*:*:*:*:*:*:*","cpe:2.3:a:markus_dahm:xalan:2.7.2:*:*:*:*:*:*:*","cpe:2.3:a:xalan:xalan:2.7.2:*:*:*:*:*:*:*"],"name":"xalan","purl":"pkg:maven/xalan/xalan@2.7.2","type":"java-archive","version":"2.7.2","language":"java","licenses":[],"metadata":{"pomGroupID":"xalan","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/xalan-2.7.2.jar","manifestName":"","pomArtifactID":"xalan","archiveDigests":[{"value":"d55d3f02a56ec4c25695fe67e1334ff8c2ecea23","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/xalan-2.7.2.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/xalan-2.7.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9339-86wc-4qgf","versionConstraint":"<2.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"xalan:xalan","version":"2.7.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9339-86wc-4qgf","fix":{"state":"fixed","versions":["2.7.3"],"available":[{"date":"2022-09-24","kind":"first-observed","version":"2.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34169","cwe":"CWE-681","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-34169","cwe":"CWE-681","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-34169","date":"2026-10-10","epss":0.81759,"percentile":0.9964}],"risk":61.319250000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-34169","https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw","https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8","http://www.openwall.com/lists/oss-security/2022/07/19/5","http://www.openwall.com/lists/oss-security/2022/07/19/6","http://www.openwall.com/lists/oss-security/2022/07/20/2","http://www.openwall.com/lists/oss-security/2022/07/20/3","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.debian.org/security/2022/dsa-5188","https://www.debian.org/security/2022/dsa-5192","http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html","https://gitbox.apache.org/repos/asf?p=xalan-java.git;a=commit;h=2e60d0a9a5b822c4abf9051857973b1c6babfe81","https://gitbox.apache.org/repos/asf?p=xalan-java.git;a=commit;h=ab57211e5d2e97cbed06786f919fa9b749c83573","https://gitbox.apache.org/repos/asf?p=xalan-java.git;a=commit;h=da3e0d06b467247643ce04e88d3346739d119f21","https://lists.apache.org/thread/x3f7xv3p1g32qj2hlg8wd57pwcpld471","http://www.openwall.com/lists/oss-security/2022/10/18/2","https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html","https://www.debian.org/security/2022/dsa-5256","http://www.openwall.com/lists/oss-security/2022/11/04/8","http://www.openwall.com/lists/oss-security/2022/11/07/2","https://xalan.apache.org","https://security.gentoo.org/glsa/202401-25","https://security.netapp.com/advisory/ntap-20240621-0006","https://security.netapp.com/advisory/ntap-20220729-0009","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9339-86wc-4qgf","description":"Apache Xalan Java XSLT library integer truncation issue when processing malicious XSLT stylesheets"},"relatedVulnerabilities":[{"id":"CVE-2022-34169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-34169","cwe":"CWE-681","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-34169","cwe":"CWE-681","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-34169","date":"2026-10-10","epss":0.81759,"percentile":0.9964}],"urls":["http://packetstormsecurity.com/files/168186/Xalan-J-XSLTC-Integer-Truncation.html","http://www.openwall.com/lists/oss-security/2022/07/19/5","http://www.openwall.com/lists/oss-security/2022/07/19/6","http://www.openwall.com/lists/oss-security/2022/07/20/2","http://www.openwall.com/lists/oss-security/2022/07/20/3","http://www.openwall.com/lists/oss-security/2022/10/18/2","http://www.openwall.com/lists/oss-security/2022/11/04/8","http://www.openwall.com/lists/oss-security/2022/11/07/2","https://lists.apache.org/thread/12pxy4phsry6c34x2ol4fft6xlho4kyw","https://lists.apache.org/thread/2qvl7r43wb4t8p9dd9om1bnkssk07sn8","https://lists.debian.org/debian-lts-announce/2022/10/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4YNJSJ64NPCNKFPNBYITNZU5H3L4D6L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5OZNAZJ4YHLOKRRRZSWRT5OJ25E4XLM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN3EVGR7FD3ZLV5SBTJXUIDCMSK4QUE2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KO3DXNKZ4EU3UZBT6AAR4XRKCD73KLMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3XPOTPPBZIPFBZHQE5E7OW6PDACUMCJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YULPNO3PAWMEQQZV2C54I3H3ZOXFZUTB/","https://security.gentoo.org/glsa/202401-25","https://security.netapp.com/advisory/ntap-20220729-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2022/dsa-5188","https://www.debian.org/security/2022/dsa-5192","https://www.debian.org/security/2022/dsa-5256","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-34169","description":"The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 or later. Note: Java runtimes (such as OpenJDK) include repackaged copies of Xalan."}]},{"artifact":{"id":"f98489f676b41ccd","cpes":["cpe:2.3:a:apache:log4j:1.2.17:*:*:*:*:*:*:*"],"name":"log4j","purl":"pkg:maven/log4j/log4j@1.2.17","type":"java-archive","version":"1.2.17","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"log4j","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:log4j:log4j","manifestName":"","pomArtifactID":"log4j","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fp5r-v3w9-4333","versionConstraint":">=1.2.0,<=1.2.17 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"log4j:log4j","version":"1.2.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fp5r-v3w9-4333","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4104","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-4104","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-4104","date":"2026-10-10","epss":0.80599,"percentile":0.9962}],"risk":60.44925,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-4104","https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126","https://access.redhat.com/security/cve/CVE-2021-4104","https://www.cve.org/CVERecord?id=CVE-2021-44228","https://www.kb.cert.org/vuls/id/930724","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033","https://security.netapp.com/advisory/ntap-20211223-0007/","http://www.openwall.com/lists/oss-security/2022/01/18/3","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202310-16","https://security.gentoo.org/glsa/202312-02","https://security.gentoo.org/glsa/202312-04"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fp5r-v3w9-4333","description":"JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data"},"relatedVulnerabilities":[{"id":"CVE-2021-4104","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6,"impactScore":6.5,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-4104","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-4104","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-4104","date":"2026-10-10","epss":0.80599,"percentile":0.9962}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/18/3","https://access.redhat.com/security/cve/CVE-2021-4104","https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202310-16","https://security.gentoo.org/glsa/202312-02","https://security.gentoo.org/glsa/202312-04","https://security.netapp.com/advisory/ntap-20211223-0007/","https://www.cve.org/CVERecord?id=CVE-2021-44228","https://www.kb.cert.org/vuls/id/930724","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-4104","description":"JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions."}]},{"artifact":{"id":"7eaafe3de0d9d3c6","cpes":["cpe:2.3:a:wget:wget:1.16-1:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/debian/wget@1.16-1?arch=amd64&distro=debian-8.5","type":"deb","version":"1.16-1","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16-1+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-13089","versionConstraint":"< 1.16-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"wget","version":"1.16-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13089","fix":{"state":"fixed","versions":["1.16-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.16-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13089","cwe":"CWE-121","type":"Secondary","source":"cret@cert.org"},{"cve":"CVE-2017-13089","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13089","date":"2026-10-10","epss":0.79855,"percentile":0.99606}],"risk":59.89125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4008-1","link":"https://security-tracker.debian.org/tracker/DSA-4008-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13089"},"relatedVulnerabilities":[{"id":"CVE-2017-13089","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"cret@cert.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13089","cwe":"CWE-121","type":"Secondary","source":"cret@cert.org"},{"cve":"CVE-2017-13089","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13089","date":"2026-10-10","epss":0.79855,"percentile":0.99606}],"urls":["http://git.savannah.gnu.org/cgit/wget.git/commit/?id=d892291fb8ace4c3b734ea5125770989c215df3f","http://www.debian.org/security/2017/dsa-4008","http://www.securityfocus.com/bid/101592","http://www.securitytracker.com/id/1039661","https://access.redhat.com/errata/RHSA-2017:3075","https://github.com/r1b/CVE-2017-13089","https://security.gentoo.org/glsa/201711-06","https://www.synology.com/support/security/Synology_SA_17_62_Wget","https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13089","description":"The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument."}]},{"artifact":{"id":"46d2cbf2678b7c07","cpes":["cpe:2.3:a:inetutils-ping:inetutils-ping:2\\:1.9.2.39.3a460-3:*:*:*:*:*:*:*","cpe:2.3:a:inetutils-ping:inetutils_ping:2\\:1.9.2.39.3a460-3:*:*:*:*:*:*:*","cpe:2.3:a:inetutils_ping:inetutils-ping:2\\:1.9.2.39.3a460-3:*:*:*:*:*:*:*","cpe:2.3:a:inetutils_ping:inetutils_ping:2\\:1.9.2.39.3a460-3:*:*:*:*:*:*:*","cpe:2.3:a:inetutils:inetutils-ping:2\\:1.9.2.39.3a460-3:*:*:*:*:*:*:*","cpe:2.3:a:inetutils:inetutils_ping:2\\:1.9.2.39.3a460-3:*:*:*:*:*:*:*"],"name":"inetutils-ping","purl":"pkg:deb/debian/inetutils-ping@2%3A1.9.2.39.3a460-3?arch=amd64&distro=debian-8.5&upstream=inetutils","type":"deb","version":"2:1.9.2.39.3a460-3","language":"","licenses":["BSD-3-clause","GFDL-1.3","GFDL-1.3+","GPL-3","GPL-3+","MIT","Wietse"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/inetutils-ping/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/inetutils-ping/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/inetutils-ping.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/inetutils-ping.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/inetutils-ping.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/inetutils-ping.list"}],"upstreams":[{"name":"inetutils"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.9.2.39.3a460-3+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10188","versionConstraint":"< 2:1.9.2.39.3a460-3+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"inetutils","version":"2:1.9.2.39.3a460-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10188","fix":{"state":"fixed","versions":["2:1.9.2.39.3a460-3+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.9.2.39.3a460-3+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-10188","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10188","date":"2026-10-10","epss":0.74339,"percentile":0.99484}],"risk":55.754250000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10188"},"relatedVulnerabilities":[{"id":"CVE-2020-10188","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10188","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10188","date":"2026-10-10","epss":0.74339,"percentile":0.99484}],"urls":["https://appgateresearch.blogspot.com/2020/02/bravestarr-fedora-31-netkit-telnetd_28.html","https://github.com/krb5/krb5-appl/blob/d00cd671dfe945791b33d4f1f6a5c57ae1667ef8/telnet/telnetd/utility.c#L205-L216","https://lists.debian.org/debian-lts-announce/2020/05/msg00012.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00038.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7FMTRRQTYKWZD2GMXX3GLZV46OLPCLVK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLU6FL24BSQQEB2SJC26NLJ2MANQDA7M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3VJ6V2Z3JRNJOBVHSOPMAC76PSSKG6A/","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-telnetd-EFJrEzPx","https://www.arista.com/en/support/advisories-notices/security-advisories/10702-security-advisory-48","https://www.oracle.com/security-alerts/cpuApr2021.html","http://www.openwall.com/lists/oss-security/2026/01/20/8"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10188","description":"utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions."}]},{"artifact":{"id":"4751753cd232098c","cpes":["cpe:2.3:a:apache:tomcat-coyote:8.0.23:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_coyote:8.0.23:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*"],"name":"tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote@8.0.23","type":"java-archive","version":"8.0.23","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/stash/lib/tomcat-coyote.jar","manifestName":"","pomArtifactID":"tomcat-coyote","archiveDigests":[{"value":"d1602d55eb7e1a6c977ca81bf5da23caba1349d3","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/lib/tomcat-coyote.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/lib/tomcat-coyote.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.5.38"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qcxh-w3j9-58qr","versionConstraint":">=8.0.0,<8.5.38 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-coyote","version":"8.0.23"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qcxh-w3j9-58qr","fix":{"state":"fixed","versions":["8.5.38"],"available":[{"date":"2026-05-21","kind":"first-observed","version":"8.5.38"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0199","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0199","date":"2026-10-10","epss":0.72855,"percentile":0.99441}],"risk":54.64125,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-0199","https://access.redhat.com/errata/RHSA-2019:3929","https://access.redhat.com/errata/RHSA-2019:3931","https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6@%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067@%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600@%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995@%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e@%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c@%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E","https://seclists.org/bugtraq/2019/Dec/43","https://support.f5.com/csp/article/K17321505","https://www.debian.org/security/2019/dsa-4596","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html","https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://web.archive.org/web/20200227030041/http://www.securityfocus.com/bid/107674","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46","https://security.netapp.com/advisory/ntap-20190419-0001"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qcxh-w3j9-58qr","description":"Apache Tomcat Denial of Service vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2019-0199","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-0199","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-0199","date":"2026-10-10","epss":0.72855,"percentile":0.99441}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00090.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00054.html","http://www.securityfocus.com/bid/107674","https://access.redhat.com/errata/RHSA-2019:3929","https://access.redhat.com/errata/RHSA-2019:3931","https://lists.apache.org/thread.html/158ab719cf60448ddbb074798f09152fdb572fc8f781e70a56118d1a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/4c438fa4c78cb1ce8979077f668ab7145baf83e7c59f2faf7eccf094%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/7bb193bc68b28d21ff1c726fd38bea164deb6333b59eec2eb3661da6%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/9fe25f98bac6d66f8a663a15c37a98bc2d8f8bbed1d408791a3e4067%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/a7a201bd23e67fd3326c9b22b814dd0537d3270b3b54a768e2e7ef50%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/ac0185ce240a711b542a55bccf9349ab0c2f343d70cf7835e08fabc9%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/cf4eb2bd2083cebb3602a293c653f9a7faa96c86f672c876f25b37ef%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/dddb3590bac28fbe89f69f5ccbe26283d014ddc691abdd042de14600%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e1b0b273b6e8ddcc72c9023bc2394b1276fc72664144bf21d0a87995%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e56886e1bac9319ecce81b3612dd7a1a43174a3a741a1c805e16880e%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/e87733036e8c84ea648cdcdca3098f3c8a897e2652c33062b2b1535c%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPHQEL5AQ6LZSZD2Y6TYZ4RC3WI7NXJ3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQTZ5BJ5F4KV6N53SGNKSW3UY5DBIQ46/","https://seclists.org/bugtraq/2019/Dec/43","https://security.netapp.com/advisory/ntap-20190419-0001/","https://support.f5.com/csp/article/K17321505","https://www.debian.org/security/2019/dsa-4596","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-0199","description":"The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS."}]},{"artifact":{"id":"f98489f676b41ccd","cpes":["cpe:2.3:a:apache:log4j:1.2.17:*:*:*:*:*:*:*"],"name":"log4j","purl":"pkg:maven/log4j/log4j@1.2.17","type":"java-archive","version":"1.2.17","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"log4j","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:log4j:log4j","manifestName":"","pomArtifactID":"log4j","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w9p3-5cr8-m3jj","versionConstraint":"<=1.2.17 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"log4j:log4j","version":"1.2.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w9p3-5cr8-m3jj","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23302","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-23302","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23302","date":"2026-10-10","epss":0.63556,"percentile":0.99198}],"risk":51.798140000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-23302","https://lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4w","https://logging.apache.org/log4j/1.2/index.html","http://www.openwall.com/lists/oss-security/2022/01/18/3","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.netapp.com/advisory/ntap-20220217-0006","https://www.vicarius.io/vsociety/posts/cve-2022-23302-detect-log4j-1217-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2022-23302-mitigate-log4j-1217-vulnerability"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w9p3-5cr8-m3jj","description":"Deserialization of Untrusted Data in Log4j 1.x"},"relatedVulnerabilities":[{"id":"CVE-2022-23302","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6,"impactScore":6.5,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23302","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-23302","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23302","date":"2026-10-10","epss":0.63556,"percentile":0.99198}],"urls":["http://www.openwall.com/lists/oss-security/2022/01/18/3","https://lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4w","https://logging.apache.org/log4j/1.2/index.html","https://security.netapp.com/advisory/ntap-20220217-0006/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.vicarius.io/vsociety/posts/cve-2022-23302-detect-log4j-1217-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2022-23302-mitigate-log4j-1217-vulnerability"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23302","description":"JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions."}]},{"artifact":{"id":"f98489f676b41ccd","cpes":["cpe:2.3:a:apache:log4j:1.2.17:*:*:*:*:*:*:*"],"name":"log4j","purl":"pkg:maven/log4j/log4j@1.2.17","type":"java-archive","version":"1.2.17","language":"java","licenses":["The Apache Software License, Version 2.0"],"metadata":{"pomGroupID":"log4j","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:log4j:log4j","manifestName":"","pomArtifactID":"log4j","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f7vh-qwp3-x37m","versionConstraint":"<=1.2.17 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"log4j:log4j","version":"1.2.17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f7vh-qwp3-x37m","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23307","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-23307","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23307","date":"2026-10-10","epss":0.54411,"percentile":0.98992}],"risk":51.14634,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-23307","https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh","https://logging.apache.org/log4j/1.2/index.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f7vh-qwp3-x37m","description":"Deserialization of Untrusted Data in Apache Log4j"},"relatedVulnerabilities":[{"id":"CVE-2022-23307","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-23307","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-23307","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-23307","date":"2026-10-10","epss":0.54411,"percentile":0.98992}],"urls":["https://lists.apache.org/thread/rg4yyc89vs3dw6kpy3r92xop9loywyhh","https://logging.apache.org/log4j/1.2/index.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23307","description":"CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists."}]},{"artifact":{"id":"d4a4e53150a9623c","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.17.2-1.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.17.2-1.1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=nss","type":"deb","version":"2:3.17.2-1.1+deb8u2","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-4000","versionConstraint":"< 2:3.26-1+debu8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"nss","version":"2:3.17.2-1.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-4000","fix":{"state":"fixed","versions":["2:3.26-1+debu8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-4000","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-4000","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-4000","date":"2026-10-10","epss":0.9986,"percentile":0.99962}],"risk":49.93,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3688-1","link":"https://security-tracker.debian.org/tracker/DSA-3688-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-4000"},"relatedVulnerabilities":[{"id":"CVE-2015-4000","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-4000","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-4000","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-4000","date":"2026-10-10","epss":0.9986,"percentile":0.99962}],"urls":["http://aix.software.ibm.com/aix/efixes/security/sendmail_advisory2.asc","http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery","http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2015-008.txt.asc","http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04876402","http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04949778","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10681","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727","http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html","http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159314.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159351.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160117.html","http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00001.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00007.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html","http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00017.html","http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00001.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00040.html","http://lists.opensuse.org/opensuse-updates/2015-07/msg00016.html","http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-02/msg00094.html","http://lists.opensuse.org/opensuse-updates/2016-02/msg00097.html","http://marc.info/?l=bugtraq&m=143506486712441&w=2","http://marc.info/?l=bugtraq&m=143557934009303&w=2","http://marc.info/?l=bugtraq&m=143558092609708&w=2","http://marc.info/?l=bugtraq&m=143628304012255&w=2","http://marc.info/?l=bugtraq&m=143637549705650&w=2","http://marc.info/?l=bugtraq&m=143655800220052&w=2","http://marc.info/?l=bugtraq&m=143880121627664&w=2","http://marc.info/?l=bugtraq&m=144043644216842&w=2","http://marc.info/?l=bugtraq&m=144050121701297&w=2","http://marc.info/?l=bugtraq&m=144060576831314&w=2","http://marc.info/?l=bugtraq&m=144060606031437&w=2","http://marc.info/?l=bugtraq&m=144061542602287&w=2","http://marc.info/?l=bugtraq&m=144069189622016&w=2","http://marc.info/?l=bugtraq&m=144102017024820&w=2","http://marc.info/?l=bugtraq&m=144104533800819&w=2","http://marc.info/?l=bugtraq&m=144493176821532&w=2","http://marc.info/?l=bugtraq&m=145409266329539&w=2","http://openwall.com/lists/oss-security/2015/05/20/8","http://rhn.redhat.com/errata/RHSA-2015-1072.html","http://rhn.redhat.com/errata/RHSA-2015-1185.html","http://rhn.redhat.com/errata/RHSA-2015-1197.html","http://rhn.redhat.com/errata/RHSA-2015-1228.html","http://rhn.redhat.com/errata/RHSA-2015-1229.html","http://rhn.redhat.com/errata/RHSA-2015-1230.html","http://rhn.redhat.com/errata/RHSA-2015-1241.html","http://rhn.redhat.com/errata/RHSA-2015-1242.html","http://rhn.redhat.com/errata/RHSA-2015-1243.html","http://rhn.redhat.com/errata/RHSA-2015-1485.html","http://rhn.redhat.com/errata/RHSA-2015-1486.html","http://rhn.redhat.com/errata/RHSA-2015-1488.html","http://rhn.redhat.com/errata/RHSA-2015-1526.html","http://rhn.redhat.com/errata/RHSA-2015-1544.html","http://rhn.redhat.com/errata/RHSA-2015-1604.html","http://rhn.redhat.com/errata/RHSA-2016-1624.html","http://rhn.redhat.com/errata/RHSA-2016-2056.html","http://support.apple.com/kb/HT204941","http://support.apple.com/kb/HT204942","http://support.citrix.com/article/CTX201114","http://www-01.ibm.com/support/docview.wss?uid=swg21959111","http://www-01.ibm.com/support/docview.wss?uid=swg21959195","http://www-01.ibm.com/support/docview.wss?uid=swg21959325","http://www-01.ibm.com/support/docview.wss?uid=swg21959453","http://www-01.ibm.com/support/docview.wss?uid=swg21959481","http://www-01.ibm.com/support/docview.wss?uid=swg21959517","http://www-01.ibm.com/support/docview.wss?uid=swg21959530","http://www-01.ibm.com/support/docview.wss?uid=swg21959539","http://www-01.ibm.com/support/docview.wss?uid=swg21959636","http://www-01.ibm.com/support/docview.wss?uid=swg21959812","http://www-01.ibm.com/support/docview.wss?uid=swg21960191","http://www-01.ibm.com/support/docview.wss?uid=swg21961717","http://www-01.ibm.com/support/docview.wss?uid=swg21962455","http://www-01.ibm.com/support/docview.wss?uid=swg21962739","http://www-304.ibm.com/support/docview.wss?uid=swg21958984","http://www-304.ibm.com/support/docview.wss?uid=swg21959132","http://www-304.ibm.com/support/docview.wss?uid=swg21960041","http://www-304.ibm.com/support/docview.wss?uid=swg21960194","http://www-304.ibm.com/support/docview.wss?uid=swg21960380","http://www-304.ibm.com/support/docview.wss?uid=swg21960418","http://www-304.ibm.com/support/docview.wss?uid=swg21962816","http://www-304.ibm.com/support/docview.wss?uid=swg21967893","http://www.debian.org/security/2015/dsa-3287","http://www.debian.org/security/2015/dsa-3300","http://www.debian.org/security/2015/dsa-3316","http://www.debian.org/security/2015/dsa-3324","http://www.debian.org/security/2015/dsa-3339","http://www.debian.org/security/2016/dsa-3688","http://www.fortiguard.com/advisory/2015-05-20-logjam-attack","http://www.mozilla.org/security/announce/2015/mfsa2015-70.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html","http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","http://www.securityfocus.com/bid/74733","http://www.securityfocus.com/bid/91787","http://www.securitytracker.com/id/1032474","http://www.securitytracker.com/id/1032475","http://www.securitytracker.com/id/1032476","http://www.securitytracker.com/id/1032637","http://www.securitytracker.com/id/1032645","http://www.securitytracker.com/id/1032647","http://www.securitytracker.com/id/1032648","http://www.securitytracker.com/id/1032649","http://www.securitytracker.com/id/1032650","http://www.securitytracker.com/id/1032651","http://www.securitytracker.com/id/1032652","http://www.securitytracker.com/id/1032653","http://www.securitytracker.com/id/1032654","http://www.securitytracker.com/id/1032655","http://www.securitytracker.com/id/1032656","http://www.securitytracker.com/id/1032688","http://www.securitytracker.com/id/1032699","http://www.securitytracker.com/id/1032702","http://www.securitytracker.com/id/1032727","http://www.securitytracker.com/id/1032759","http://www.securitytracker.com/id/1032777","http://www.securitytracker.com/id/1032778","http://www.securitytracker.com/id/1032783","http://www.securitytracker.com/id/1032784","http://www.securitytracker.com/id/1032856","http://www.securitytracker.com/id/1032864","http://www.securitytracker.com/id/1032865","http://www.securitytracker.com/id/1032871","http://www.securitytracker.com/id/1032884","http://www.securitytracker.com/id/1032910","http://www.securitytracker.com/id/1032932","http://www.securitytracker.com/id/1032960","http://www.securitytracker.com/id/1033019","http://www.securitytracker.com/id/1033064","http://www.securitytracker.com/id/1033065","http://www.securitytracker.com/id/1033067","http://www.securitytracker.com/id/1033208","http://www.securitytracker.com/id/1033209","http://www.securitytracker.com/id/1033210","http://www.securitytracker.com/id/1033222","http://www.securitytracker.com/id/1033341","http://www.securitytracker.com/id/1033385","http://www.securitytracker.com/id/1033416","http://www.securitytracker.com/id/1033430","http://www.securitytracker.com/id/1033433","http://www.securitytracker.com/id/1033513","http://www.securitytracker.com/id/1033760","http://www.securitytracker.com/id/1033891","http://www.securitytracker.com/id/1033991","http://www.securitytracker.com/id/1034087","http://www.securitytracker.com/id/1034728","http://www.securitytracker.com/id/1034884","http://www.securitytracker.com/id/1036218","http://www.securitytracker.com/id/1040630","http://www.solarwinds.com/documentation/storage/storagemanager/docs/ReleaseNotes/releaseNotes.htm","http://www.ubuntu.com/usn/USN-2656-1","http://www.ubuntu.com/usn/USN-2656-2","http://www.ubuntu.com/usn/USN-2673-1","http://www.ubuntu.com/usn/USN-2696-1","http://www.ubuntu.com/usn/USN-2706-1","https://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/","https://bto.bluecoat.com/security-advisory/sa98","https://bugzilla.mozilla.org/show_bug.cgi?id=1138554","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.1_release_notes","https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04718196","https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140","https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190","https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119","https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241","https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246","https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04918839","https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04923929","https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04740527","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04953655","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128722","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193083","https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes","https://kc.mcafee.com/corporate/index?page=content&id=SB10122","https://openssl.org/news/secadv/20150611.txt","https://puppet.com/security/cve/CVE-2015-4000","https://security.gentoo.org/glsa/201506-02","https://security.gentoo.org/glsa/201512-10","https://security.gentoo.org/glsa/201603-11","https://security.gentoo.org/glsa/201701-46","https://security.netapp.com/advisory/ntap-20150619-0001/","https://support.citrix.com/article/CTX216642","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03831en_us","https://weakdh.org/","https://weakdh.org/imperfect-forward-secrecy.pdf","https://www-304.ibm.com/support/docview.wss?uid=swg21959745","https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098403","https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/","https://www.openssl.org/news/secadv_20150611.txt","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.suse.com/security/cve/CVE-2015-4000.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-4000","description":"The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the \"Logjam\" issue."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6304","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6304","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6304","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6304","date":"2026-10-10","epss":0.63029,"percentile":0.99186}],"risk":47.271750000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6304"},"relatedVulnerabilities":[{"id":"CVE-2016-6304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6304","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6304","date":"2026-10-10","epss":0.63029,"percentile":0.99186}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://rhn.redhat.com/errata/RHSA-2016-2802.html","http://rhn.redhat.com/errata/RHSA-2017-1415.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/fulldisclosure/2016/Dec/47","http://seclists.org/fulldisclosure/2016/Oct/62","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/93150","http://www.securitytracker.com/id/1036878","http://www.securitytracker.com/id/1037640","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2017:1413","https://access.redhat.com/errata/RHSA-2017:1414","https://access.redhat.com/errata/RHSA-2017:1658","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.openssl.org/news/secadv/20160922.txt","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6304","description":"Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6304","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6304","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6304","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6304","date":"2026-10-10","epss":0.63029,"percentile":0.99186}],"risk":47.271750000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6304"},"relatedVulnerabilities":[{"id":"CVE-2016-6304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6304","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6304","date":"2026-10-10","epss":0.63029,"percentile":0.99186}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://rhn.redhat.com/errata/RHSA-2016-2802.html","http://rhn.redhat.com/errata/RHSA-2017-1415.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/fulldisclosure/2016/Dec/47","http://seclists.org/fulldisclosure/2016/Oct/62","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/93150","http://www.securitytracker.com/id/1036878","http://www.securitytracker.com/id/1037640","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2017:1413","https://access.redhat.com/errata/RHSA-2017:1414","https://access.redhat.com/errata/RHSA-2017:1658","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.openssl.org/news/secadv/20160922.txt","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6304","description":"Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rfx6-vp9g-rh7v","versionConstraint":"<2.7.9.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rfx6-vp9g-rh7v","fix":{"state":"fixed","versions":["2.7.9.2"],"available":[{"date":"2024-03-02","kind":"first-observed","version":"2.7.9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-17485","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-17485","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-17485","date":"2026-10-10","epss":0.49727,"percentile":0.98872}],"risk":46.74338,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-17485","https://github.com/FasterXML/jackson-databind/issues/1855","https://access.redhat.com/errata/RHSA-2018:0116","https://access.redhat.com/errata/RHSA-2018:0342","https://access.redhat.com/errata/RHSA-2018:0478","https://access.redhat.com/errata/RHSA-2018:0479","https://access.redhat.com/errata/RHSA-2018:0480","https://access.redhat.com/errata/RHSA-2018:0481","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:2930","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2018/dsa-4114","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/10fe7f17ea7c8da2a71e7a0c774b420a1d5c1b50","https://github.com/FasterXML/jackson-databind/commit/2235894210c75f624a3d0cd60bfb0434a20a18bf","https://github.com/FasterXML/jackson-databind/commit/459107dccc9b3ea991af3e6ad0953e54b01ef7c1","https://github.com/FasterXML/jackson-databind/commit/4f16f67ebd22c7522fdbb8a7eb87e3026a807d61","https://github.com/FasterXML/jackson-databind/commit/978798382ceb72229e5036aa1442943933d6d171","https://github.com/FasterXML/jackson-databind/commit/bb45fb16709018842f858f1a6e1118676aaa34bd","https://github.com/FasterXML/jackson-databind/commit/eb217dd0f87c5fb471e0668575644aa7eba9a3d3","https://github.com/FasterXML/jackson-databind/commit/f031f27a31625d07922bdd090664c69544200a5d","https://github.com/irsl/jackson-rce-via-spel","https://security.netapp.com/advisory/ntap-20180201-0003","https://web.archive.org/web/20200927162225/http://www.securityfocus.com/archive/1/541652/100/0/threaded"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rfx6-vp9g-rh7v","description":"jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass"},"relatedVulnerabilities":[{"id":"CVE-2017-17485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-17485","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-17485","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-17485","date":"2026-10-10","epss":0.49727,"percentile":0.98872}],"urls":["http://www.securityfocus.com/archive/1/541652/100/0/threaded","https://access.redhat.com/errata/RHSA-2018:0116","https://access.redhat.com/errata/RHSA-2018:0342","https://access.redhat.com/errata/RHSA-2018:0478","https://access.redhat.com/errata/RHSA-2018:0479","https://access.redhat.com/errata/RHSA-2018:0480","https://access.redhat.com/errata/RHSA-2018:0481","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:2930","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://github.com/FasterXML/jackson-databind/issues/1855","https://github.com/irsl/jackson-rce-via-spel/","https://security.netapp.com/advisory/ntap-20180201-0003/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2018/dsa-4114","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-17485","description":"FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rfx6-vp9g-rh7v","versionConstraint":"<2.7.9.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rfx6-vp9g-rh7v","fix":{"state":"fixed","versions":["2.7.9.2"],"available":[{"date":"2024-03-02","kind":"first-observed","version":"2.7.9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-17485","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-17485","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-17485","date":"2026-10-10","epss":0.49727,"percentile":0.98872}],"risk":46.74338,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-17485","https://github.com/FasterXML/jackson-databind/issues/1855","https://access.redhat.com/errata/RHSA-2018:0116","https://access.redhat.com/errata/RHSA-2018:0342","https://access.redhat.com/errata/RHSA-2018:0478","https://access.redhat.com/errata/RHSA-2018:0479","https://access.redhat.com/errata/RHSA-2018:0480","https://access.redhat.com/errata/RHSA-2018:0481","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:2930","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2018/dsa-4114","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/10fe7f17ea7c8da2a71e7a0c774b420a1d5c1b50","https://github.com/FasterXML/jackson-databind/commit/2235894210c75f624a3d0cd60bfb0434a20a18bf","https://github.com/FasterXML/jackson-databind/commit/459107dccc9b3ea991af3e6ad0953e54b01ef7c1","https://github.com/FasterXML/jackson-databind/commit/4f16f67ebd22c7522fdbb8a7eb87e3026a807d61","https://github.com/FasterXML/jackson-databind/commit/978798382ceb72229e5036aa1442943933d6d171","https://github.com/FasterXML/jackson-databind/commit/bb45fb16709018842f858f1a6e1118676aaa34bd","https://github.com/FasterXML/jackson-databind/commit/eb217dd0f87c5fb471e0668575644aa7eba9a3d3","https://github.com/FasterXML/jackson-databind/commit/f031f27a31625d07922bdd090664c69544200a5d","https://github.com/irsl/jackson-rce-via-spel","https://security.netapp.com/advisory/ntap-20180201-0003","https://web.archive.org/web/20200927162225/http://www.securityfocus.com/archive/1/541652/100/0/threaded"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rfx6-vp9g-rh7v","description":"jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass"},"relatedVulnerabilities":[{"id":"CVE-2017-17485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-17485","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-17485","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-17485","date":"2026-10-10","epss":0.49727,"percentile":0.98872}],"urls":["http://www.securityfocus.com/archive/1/541652/100/0/threaded","https://access.redhat.com/errata/RHSA-2018:0116","https://access.redhat.com/errata/RHSA-2018:0342","https://access.redhat.com/errata/RHSA-2018:0478","https://access.redhat.com/errata/RHSA-2018:0479","https://access.redhat.com/errata/RHSA-2018:0480","https://access.redhat.com/errata/RHSA-2018:0481","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:2930","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://github.com/FasterXML/jackson-databind/issues/1855","https://github.com/irsl/jackson-rce-via-spel/","https://security.netapp.com/advisory/ntap-20180201-0003/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2018/dsa-4114","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-17485","description":"FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath."}]},{"artifact":{"id":"3eb92f7ec39e3872","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@2.5.6.SEC03","type":"java-archive","version":"2.5.6.SEC03","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:embedded-crowd-admin-plugin-1.8.4.jar:META-INF/lib/spring-webmvc-2.5.6.SEC03.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"275c5ac6ade12819f49e984c8e06b114a4e23458","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:embedded-crowd-admin-plugin-1.8.4.jar:META-INF/lib/spring-webmvc-2.5.6.SEC03.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.2.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8cmm-qj8g-fcp6","versionConstraint":"<3.2.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"2.5.6.SEC03"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8cmm-qj8g-fcp6","fix":{"state":"fixed","versions":["3.2.8"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"3.2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-0054","cwe":"CWE-352","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0054","date":"2026-10-10","epss":0.91354,"percentile":0.99811}],"risk":45.677,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2014-0054","http://rhn.redhat.com/errata/RHSA-2014-0400.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","https://github.com/spring-projects/spring-framework/issues/16003","https://github.com/spring-projects/spring-framework/commit/1a8629d40825c073b6863ae2ab748b647b28506a","https://github.com/spring-projects/spring-framework/commit/1c5cab2a4069ec3239c531d741aeb07a434f521b","https://github.com/spring-projects/spring-framework/commit/edba32b3093703d5e9ed42b5b8ec23ecc1998398","https://github.com/spring-projects/spring-framework/commit/fb0683c066e74e9667d6cd8c5fa01f674c68c3be"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8cmm-qj8g-fcp6","description":"Cross-Site Request Forgery in Spring Framework"},"relatedVulnerabilities":[{"id":"CVE-2014-0054","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-0054","cwe":"CWE-352","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-0054","date":"2026-10-10","epss":0.91354,"percentile":0.99811}],"urls":["http://rhn.redhat.com/errata/RHSA-2014-0400.html","http://secunia.com/advisories/57915","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/66148","https://jira.spring.io/browse/SPR-11376"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-0054","description":"The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429."}]},{"artifact":{"id":"3eb92f7ec39e3872","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@2.5.6.SEC03","type":"java-archive","version":"2.5.6.SEC03","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:embedded-crowd-admin-plugin-1.8.4.jar:META-INF/lib/spring-webmvc-2.5.6.SEC03.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"275c5ac6ade12819f49e984c8e06b114a4e23458","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:embedded-crowd-admin-plugin-1.8.4.jar:META-INF/lib/spring-webmvc-2.5.6.SEC03.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g5vr-rgqm-vf78","versionConstraint":"<=5.3.40 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"2.5.6.SEC03"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-g5vr-rgqm-vf78","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38819","cwe":"CWE-22","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2024-38819","date":"2026-10-10","epss":0.5604,"percentile":0.9903}],"risk":42.03,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-38819","https://spring.io/security/cve-2024-38819","https://github.com/spring-projects/spring-framework/issues/33689","https://github.com/spring-projects/spring-framework/commit/3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d","https://github.com/spring-projects/spring-framework/commit/fb7890d73975a3d9e0763e0926df2bd0a608e87e","https://security.netapp.com/advisory/ntap-20250110-0010"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","description":"Spring Framework Path Traversal vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-38819","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38819","cwe":"CWE-22","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2024-38819","date":"2026-10-10","epss":0.5604,"percentile":0.9903}],"urls":["https://spring.io/security/cve-2024-38819","https://security.netapp.com/advisory/ntap-20250110-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38819","description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running."}]},{"artifact":{"id":"38a684e8390fbe0f","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:4.1.6.RELEASE:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@4.1.6.RELEASE","type":"java-archive","version":"4.1.6.RELEASE","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-webmvc-4.1.6.RELEASE.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"e1ee19a5359f214d65cc18972df8aba17ce1e423","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-webmvc-4.1.6.RELEASE.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-webmvc-4.1.6.RELEASE.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g5vr-rgqm-vf78","versionConstraint":"<=5.3.40 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"4.1.6.RELEASE"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-g5vr-rgqm-vf78","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38819","cwe":"CWE-22","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2024-38819","date":"2026-10-10","epss":0.5604,"percentile":0.9903}],"risk":42.03,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-38819","https://spring.io/security/cve-2024-38819","https://github.com/spring-projects/spring-framework/issues/33689","https://github.com/spring-projects/spring-framework/commit/3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d","https://github.com/spring-projects/spring-framework/commit/fb7890d73975a3d9e0763e0926df2bd0a608e87e","https://security.netapp.com/advisory/ntap-20250110-0010"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g5vr-rgqm-vf78","description":"Spring Framework Path Traversal vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-38819","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-38819","cwe":"CWE-22","type":"Secondary","source":"security@vmware.com"}],"epss":[{"cve":"CVE-2024-38819","date":"2026-10-10","epss":0.5604,"percentile":0.9903}],"urls":["https://spring.io/security/cve-2024-38819","https://security.netapp.com/advisory/ntap-20250110-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38819","description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running."}]},{"artifact":{"id":"1b0f8262f0bac2cd","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-1000117","versionConstraint":"< 1:2.1.4-2.1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000117","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000117","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000117","date":"2026-10-10","epss":0.77823,"percentile":0.99563}],"risk":38.9115,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3934-1","link":"https://security-tracker.debian.org/tracker/DSA-3934-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000117"},"relatedVulnerabilities":[{"id":"CVE-2017-1000117","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000117","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000117","date":"2026-10-10","epss":0.77823,"percentile":0.99563}],"urls":["http://www.debian.org/security/2017/dsa-3934","http://www.securityfocus.com/bid/100283","http://www.securitytracker.com/id/1039131","https://access.redhat.com/errata/RHSA-2017:2484","https://access.redhat.com/errata/RHSA-2017:2485","https://access.redhat.com/errata/RHSA-2017:2491","https://access.redhat.com/errata/RHSA-2017:2674","https://access.redhat.com/errata/RHSA-2017:2675","https://security.gentoo.org/glsa/201709-10","https://support.apple.com/HT208103","https://www.exploit-db.com/exploits/42599/","https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1466490.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000117","description":"A malicious third-party can give a crafted \"ssh://...\" URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running \"git clone --recurse-submodules\" to trigger the vulnerability."}]},{"artifact":{"id":"c887d301ab2f172c","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u2?arch=all&distro=debian-8.5&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000117","versionConstraint":"< 1:2.1.4-2.1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000117","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000117","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000117","date":"2026-10-10","epss":0.77823,"percentile":0.99563}],"risk":38.9115,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3934-1","link":"https://security-tracker.debian.org/tracker/DSA-3934-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000117"},"relatedVulnerabilities":[{"id":"CVE-2017-1000117","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000117","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000117","date":"2026-10-10","epss":0.77823,"percentile":0.99563}],"urls":["http://www.debian.org/security/2017/dsa-3934","http://www.securityfocus.com/bid/100283","http://www.securitytracker.com/id/1039131","https://access.redhat.com/errata/RHSA-2017:2484","https://access.redhat.com/errata/RHSA-2017:2485","https://access.redhat.com/errata/RHSA-2017:2491","https://access.redhat.com/errata/RHSA-2017:2674","https://access.redhat.com/errata/RHSA-2017:2675","https://security.gentoo.org/glsa/201709-10","https://support.apple.com/HT208103","https://www.exploit-db.com/exploits/42599/","https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1466490.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000117","description":"A malicious third-party can give a crafted \"ssh://...\" URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running \"git clone --recurse-submodules\" to trigger the vulnerability."}]},{"artifact":{"id":"086860a1c675b6eb","cpes":["cpe:2.3:a:libgnutls-deb0-28:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0-28:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*"],"name":"libgnutls-deb0-28","purl":"pkg:deb/debian/libgnutls-deb0-28@3.3.8-6%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=gnutls28","type":"deb","version":"3.3.8-6+deb8u3","language":"","licenses":["sha256:cffad6d97811bc8c8755b86819dbece70c2da355bf2d50a24bdc0e85a6cc2fef"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-deb0-28/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libgnutls-deb0-28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-3389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"gnutls28","version":"3.3.8-6+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2011-3389","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-10","epss":0.73327,"percentile":0.99454}],"risk":36.6635,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2011-3389"},"relatedVulnerabilities":[{"id":"CVE-2011-3389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-3389","cwe":"CWE-326","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-3389","date":"2026-10-10","epss":0.73327,"percentile":0.99454}],"urls":["http://blog.mozilla.com/security/2011/09/27/attack-against-tls-protected-communications/","http://blogs.technet.com/b/msrc/archive/2011/09/26/microsoft-releases-security-advisory-2588513.aspx","http://blogs.technet.com/b/srd/archive/2011/09/26/is-ssl-broken-more-about-security-advisory-2588513.aspx","http://curl.haxx.se/docs/adv_20120124B.html","http://downloads.asterisk.org/pub/security/AST-2016-001.html","http://ekoparty.org/2011/juliano-rizzo.php","http://eprint.iacr.org/2004/111","http://eprint.iacr.org/2006/136","http://googlechromereleases.blogspot.com/2011/10/chrome-stable-release.html","http://isc.sans.edu/diary/SSL+TLS+part+3+/11635","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html","http://lists.apple.com/archives/Security-announce/2011//Oct/msg00002.html","http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html","http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2012/May/msg00001.html","http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html","http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://marc.info/?l=bugtraq&m=132750579901589&w=2","http://marc.info/?l=bugtraq&m=132872385320240&w=2","http://marc.info/?l=bugtraq&m=133365109612558&w=2","http://marc.info/?l=bugtraq&m=133728004526190&w=2","http://marc.info/?l=bugtraq&m=134254866602253&w=2","http://marc.info/?l=bugtraq&m=134254957702612&w=2","http://my.opera.com/securitygroup/blog/2011/09/28/the-beast-ssl-tls-issue","http://osvdb.org/74829","http://rhn.redhat.com/errata/RHSA-2012-0508.html","http://rhn.redhat.com/errata/RHSA-2013-1455.html","http://secunia.com/advisories/45791","http://secunia.com/advisories/47998","http://secunia.com/advisories/48256","http://secunia.com/advisories/48692","http://secunia.com/advisories/48915","http://secunia.com/advisories/48948","http://secunia.com/advisories/49198","http://secunia.com/advisories/55322","http://secunia.com/advisories/55350","http://secunia.com/advisories/55351","http://security.gentoo.org/glsa/glsa-201203-02.xml","http://security.gentoo.org/glsa/glsa-201406-32.xml","http://support.apple.com/kb/HT4999","http://support.apple.com/kb/HT5001","http://support.apple.com/kb/HT5130","http://support.apple.com/kb/HT5281","http://support.apple.com/kb/HT5501","http://support.apple.com/kb/HT6150","http://technet.microsoft.com/security/advisory/2588513","http://vnhacker.blogspot.com/2011/09/beast.html","http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf","http://www.debian.org/security/2012/dsa-2398","http://www.educatedguesswork.org/2011/09/security_impact_of_the_rizzodu.html","http://www.ibm.com/developerworks/java/jdk/alerts/","http://www.imperialviolet.org/2011/09/23/chromeandbeast.html","http://www.insecure.cl/Beast-SSL.rar","http://www.kb.cert.org/vuls/id/864643","http://www.mandriva.com/security/advisories?name=MDVSA-2012:058","http://www.opera.com/docs/changelogs/mac/1151/","http://www.opera.com/docs/changelogs/mac/1160/","http://www.opera.com/docs/changelogs/unix/1151/","http://www.opera.com/docs/changelogs/unix/1160/","http://www.opera.com/docs/changelogs/windows/1151/","http://www.opera.com/docs/changelogs/windows/1160/","http://www.opera.com/support/kb/view/1004/","http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html","http://www.redhat.com/support/errata/RHSA-2011-1384.html","http://www.redhat.com/support/errata/RHSA-2012-0006.html","http://www.securityfocus.com/bid/49388","http://www.securityfocus.com/bid/49778","http://www.securitytracker.com/id/1029190","http://www.securitytracker.com/id?1025997","http://www.securitytracker.com/id?1026103","http://www.securitytracker.com/id?1026704","http://www.ubuntu.com/usn/USN-1263-1","http://www.us-cert.gov/cas/techalerts/TA12-010A.html","https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_fetchmail","https://bugzilla.novell.com/show_bug.cgi?id=719047","https://bugzilla.redhat.com/show_bug.cgi?id=737506","https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf","https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-006","https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862","https://hermes.opensuse.org/messages/13154861","https://hermes.opensuse.org/messages/13155432","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14752"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-3389","description":"The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a \"BEAST\" attack."}]},{"artifact":{"id":"5ee0f988b6436bdb","cpes":["cpe:2.3:a:apache:commons-fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.3.1:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.3.1","type":"java-archive","version":"1.3.1","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-rest-module-2.9.24.jar:commons-fileupload:commons-fileupload","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-rest-module-2.9.24.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hfrx-6qgj-fp6c","versionConstraint":"<1.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hfrx-6qgj-fp6c","fix":{"state":"fixed","versions":["1.5"],"available":[{"date":"2023-02-23","kind":"first-observed","version":"1.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24998","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2023-24998","date":"2026-10-10","epss":0.48788,"percentile":0.9885}],"risk":36.590999999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-24998","https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy","https://github.com/apache/commons-fileupload/commit/e20c04990f7420ca917e96a84cec58b13a1b3d17","https://commons.apache.org/proper/commons-fileupload/security-reports.html","http://www.openwall.com/lists/oss-security/2023/05/22/1","https://security.gentoo.org/glsa/202305-37","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://www.debian.org/security/2023/dsa-5522","https://github.com/apache/tomcat/commit/8a2285f13affa961cc65595aad999db5efae45ce","https://github.com/apache/tomcat/commit/9ca96c8c1eba86c0aaa2e6be581ba2a7d4d4ae6e","https://github.com/apache/tomcat/commit/cf77cc545de0488fb89e24294151504a7432df74","https://github.com/apache/tomcat/commit/d53d8e7f77042cc32a3b98f589496a1ef5088e38","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-8.html","https://tomcat.apache.org/security-9.html","https://github.com/search?q=repo%3Aapache%2Ftomcat+util.http+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=code","https://security.netapp.com/advisory/ntap-20230302-0013","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://security.netapp.com/advisory/ntap-20241108-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hfrx-6qgj-fp6c","description":"Apache Commons FileUpload denial of service vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2023-24998","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24998","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2023-24998","date":"2026-10-10","epss":0.48788,"percentile":0.9885}],"urls":["http://www.openwall.com/lists/oss-security/2023/05/22/1","https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://security.gentoo.org/glsa/202305-37","https://www.debian.org/security/2023/dsa-5522","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://security.netapp.com/advisory/ntap-20230302-0013/","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24998","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\n\n\n\n\nNote that, like all of the file upload limits, the\n          new configuration option (FileUploadBase#setFileCountMax) is not\n          enabled by default and must be explicitly configured."}]},{"artifact":{"id":"82038657ac90fdfa","cpes":["cpe:2.3:a:apache:commons-fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.3.1:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.3.1","type":"java-archive","version":"1.3.1","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-fileupload-1.3.1.jar","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":[{"value":"c621b54583719ac0310404463d6d99db27e1052c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-fileupload-1.3.1.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-fileupload-1.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hfrx-6qgj-fp6c","versionConstraint":"<1.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hfrx-6qgj-fp6c","fix":{"state":"fixed","versions":["1.5"],"available":[{"date":"2023-02-23","kind":"first-observed","version":"1.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24998","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2023-24998","date":"2026-10-10","epss":0.48788,"percentile":0.9885}],"risk":36.590999999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-24998","https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy","https://github.com/apache/commons-fileupload/commit/e20c04990f7420ca917e96a84cec58b13a1b3d17","https://commons.apache.org/proper/commons-fileupload/security-reports.html","http://www.openwall.com/lists/oss-security/2023/05/22/1","https://security.gentoo.org/glsa/202305-37","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://www.debian.org/security/2023/dsa-5522","https://github.com/apache/tomcat/commit/8a2285f13affa961cc65595aad999db5efae45ce","https://github.com/apache/tomcat/commit/9ca96c8c1eba86c0aaa2e6be581ba2a7d4d4ae6e","https://github.com/apache/tomcat/commit/cf77cc545de0488fb89e24294151504a7432df74","https://github.com/apache/tomcat/commit/d53d8e7f77042cc32a3b98f589496a1ef5088e38","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-8.html","https://tomcat.apache.org/security-9.html","https://github.com/search?q=repo%3Aapache%2Ftomcat+util.http+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=code","https://security.netapp.com/advisory/ntap-20230302-0013","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://security.netapp.com/advisory/ntap-20241108-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hfrx-6qgj-fp6c","description":"Apache Commons FileUpload denial of service vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2023-24998","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24998","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2023-24998","date":"2026-10-10","epss":0.48788,"percentile":0.9885}],"urls":["http://www.openwall.com/lists/oss-security/2023/05/22/1","https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://security.gentoo.org/glsa/202305-37","https://www.debian.org/security/2023/dsa-5522","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://security.netapp.com/advisory/ntap-20230302-0013/","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24998","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\n\n\n\n\nNote that, like all of the file upload limits, the\n          new configuration option (FileUploadBase#setFileCountMax) is not\n          enabled by default and must be explicitly configured."}]},{"artifact":{"id":"eef380ca8b0cdbdf","cpes":["cpe:2.3:a:apache:commons-fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.3.1:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.3.1","type":"java-archive","version":"1.3.1","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-universal-plugin-manager-plugin-2.18.4.jar:commons-fileupload:commons-fileupload","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-universal-plugin-manager-plugin-2.18.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hfrx-6qgj-fp6c","versionConstraint":"<1.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hfrx-6qgj-fp6c","fix":{"state":"fixed","versions":["1.5"],"available":[{"date":"2023-02-23","kind":"first-observed","version":"1.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24998","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2023-24998","date":"2026-10-10","epss":0.48788,"percentile":0.9885}],"risk":36.590999999999994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-24998","https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy","https://github.com/apache/commons-fileupload/commit/e20c04990f7420ca917e96a84cec58b13a1b3d17","https://commons.apache.org/proper/commons-fileupload/security-reports.html","http://www.openwall.com/lists/oss-security/2023/05/22/1","https://security.gentoo.org/glsa/202305-37","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://www.debian.org/security/2023/dsa-5522","https://github.com/apache/tomcat/commit/8a2285f13affa961cc65595aad999db5efae45ce","https://github.com/apache/tomcat/commit/9ca96c8c1eba86c0aaa2e6be581ba2a7d4d4ae6e","https://github.com/apache/tomcat/commit/cf77cc545de0488fb89e24294151504a7432df74","https://github.com/apache/tomcat/commit/d53d8e7f77042cc32a3b98f589496a1ef5088e38","https://tomcat.apache.org/security-10.html","https://tomcat.apache.org/security-11.html","https://tomcat.apache.org/security-8.html","https://tomcat.apache.org/security-9.html","https://github.com/search?q=repo%3Aapache%2Ftomcat+util.http+path%3A%2F%5Eres%5C%2Fbnd%5C%2F%2F&type=code","https://security.netapp.com/advisory/ntap-20230302-0013","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://security.netapp.com/advisory/ntap-20241108-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hfrx-6qgj-fp6c","description":"Apache Commons FileUpload denial of service vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2023-24998","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24998","cwe":"CWE-770","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2023-24998","date":"2026-10-10","epss":0.48788,"percentile":0.9885}],"urls":["http://www.openwall.com/lists/oss-security/2023/05/22/1","https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy","https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html","https://security.gentoo.org/glsa/202305-37","https://www.debian.org/security/2023/dsa-5522","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://security.netapp.com/advisory/ntap-20230302-0013/","https://security.netapp.com/advisory/ntap-20241108-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24998","description":"Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.\n\n\n\n\nNote that, like all of the file upload limits, the\n          new configuration option (FileUploadBase#setFileCountMax) is not\n          enabled by default and must be explicitly configured."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qxxx-2pp7-5hmx","versionConstraint":"<=2.6.7.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qxxx-2pp7-5hmx","fix":{"state":"fixed","versions":["2.6.7.1"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"2.6.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7525","cwe":"CWE-184","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2017-7525","cwe":"CWE-502","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7525","date":"2026-10-10","epss":0.37721,"percentile":0.98512}],"risk":35.45774,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-7525","https://github.com/FasterXML/jackson-databind/issues/1599","https://github.com/FasterXML/jackson-databind/issues/1723","https://access.redhat.com/errata/RHSA-2017:1834","https://access.redhat.com/errata/RHSA-2017:1835","https://access.redhat.com/errata/RHSA-2017:1836","https://access.redhat.com/errata/RHSA-2017:1837","https://access.redhat.com/errata/RHSA-2017:1839","https://access.redhat.com/errata/RHSA-2017:1840","https://access.redhat.com/errata/RHSA-2017:2477","https://access.redhat.com/errata/RHSA-2017:2546","https://access.redhat.com/errata/RHSA-2017:2547","https://access.redhat.com/errata/RHSA-2017:2633","https://access.redhat.com/errata/RHSA-2017:2635","https://access.redhat.com/errata/RHSA-2017:2636","https://access.redhat.com/errata/RHSA-2017:2637","https://access.redhat.com/errata/RHSA-2017:2638","https://access.redhat.com/errata/RHSA-2017:3141","https://access.redhat.com/errata/RHSA-2017:3454","https://access.redhat.com/errata/RHSA-2017:3455","https://access.redhat.com/errata/RHSA-2017:3456","https://access.redhat.com/errata/RHSA-2017:3458","https://access.redhat.com/errata/RHSA-2018:0294","https://access.redhat.com/errata/RHSA-2018:0342","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2019:0910","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://bugzilla.redhat.com/show_bug.cgi?id=1462702","https://cwiki.apache.org/confluence/display/WW/S2-055","https://lists.apache.org/thread.html/3c87dc8bca99a2b3b4743713b33d1de05b1d6b761fdf316224e9c81f@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/4641ed8616ccc2c1fbddac2c3dc9900c96387bc226eaf0232d61909b@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/5008bcbd45ee65ce39e4220b6ac53d28a24d6bc67d5804e9773a7399@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/b1f33fe5ade396bb903fdcabe9f243f7692c7dfce5418d3743c2d346@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/c10a2bf0fdc3d25faf17bd191d6ec46b29a353fa9c97bebd7c4e5913@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/c2ed4c0126b43e324cf740012a0edd371fd36096fd777be7bfe7a2a6@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/c9d5ff20929e8a3c8794facf4c4b326a9c10618812eec356caa20b87@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/f60afd3c7e9ebaaf70fad4a4beb75cf8740ac959017a31e7006c7486@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589@%3Cissues.spark.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2017/dsa-4004","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","https://lists.apache.org/thread.html/r42ac3e39e6265db12d9fc6ae1cd4b5fea7aed9830dc6f6d58228fed7@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rf7f87810c38dc9abf9f93989f76008f504cbf7c1a355214640b2d04c@%3Ccommits.cassandra.apache.org%3E","https://github.com/FasterXML/jackson-databind/commit/3bfbb835e530055c1941ddf87fde0b08d08dcd38","https://github.com/FasterXML/jackson-databind/commit/60d459cedcf079c6106ae7da2ac562bc32dcabe1","https://github.com/FasterXML/jackson-databind/commit/680d75b011edd67a2d2a2e9980998a968194c2ef","https://github.com/FasterXML/jackson-databind/commit/6ce32ffd18facac6abdbbf559c817b47fcb622c1","https://github.com/FasterXML/jackson-databind/commit/90042692085deeb05ae75c569c9909f7dba24415","https://github.com/FasterXML/jackson-databind/commit/fa87c1ddbe803ebb7295f5c2ebfe38e12f6e6162","https://github.com/FasterXML/jackson-databind/commit/fd8dec2c7fab8b4b4bd60502a0f1d63ec23c24da","https://security.netapp.com/advisory/ntap-20171214-0002"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qxxx-2pp7-5hmx","description":"jackson-databind is vulnerable to a deserialization flaw"},"relatedVulnerabilities":[{"id":"CVE-2017-7525","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7525","cwe":"CWE-184","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2017-7525","cwe":"CWE-502","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7525","date":"2026-10-10","epss":0.37721,"percentile":0.98512}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/99623","http://www.securitytracker.com/id/1039744","http://www.securitytracker.com/id/1039947","http://www.securitytracker.com/id/1040360","https://access.redhat.com/errata/RHSA-2017:1834","https://access.redhat.com/errata/RHSA-2017:1835","https://access.redhat.com/errata/RHSA-2017:1836","https://access.redhat.com/errata/RHSA-2017:1837","https://access.redhat.com/errata/RHSA-2017:1839","https://access.redhat.com/errata/RHSA-2017:1840","https://access.redhat.com/errata/RHSA-2017:2477","https://access.redhat.com/errata/RHSA-2017:2546","https://access.redhat.com/errata/RHSA-2017:2547","https://access.redhat.com/errata/RHSA-2017:2633","https://access.redhat.com/errata/RHSA-2017:2635","https://access.redhat.com/errata/RHSA-2017:2636","https://access.redhat.com/errata/RHSA-2017:2637","https://access.redhat.com/errata/RHSA-2017:2638","https://access.redhat.com/errata/RHSA-2017:3141","https://access.redhat.com/errata/RHSA-2017:3454","https://access.redhat.com/errata/RHSA-2017:3455","https://access.redhat.com/errata/RHSA-2017:3456","https://access.redhat.com/errata/RHSA-2017:3458","https://access.redhat.com/errata/RHSA-2018:0294","https://access.redhat.com/errata/RHSA-2018:0342","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2019:0910","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://bugzilla.redhat.com/show_bug.cgi?id=1462702","https://cwiki.apache.org/confluence/display/WW/S2-055","https://github.com/FasterXML/jackson-databind/issues/1599","https://github.com/FasterXML/jackson-databind/issues/1723","https://lists.apache.org/thread.html/3c87dc8bca99a2b3b4743713b33d1de05b1d6b761fdf316224e9c81f%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/4641ed8616ccc2c1fbddac2c3dc9900c96387bc226eaf0232d61909b%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/5008bcbd45ee65ce39e4220b6ac53d28a24d6bc67d5804e9773a7399%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/b1f33fe5ade396bb903fdcabe9f243f7692c7dfce5418d3743c2d346%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/c10a2bf0fdc3d25faf17bd191d6ec46b29a353fa9c97bebd7c4e5913%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/c2ed4c0126b43e324cf740012a0edd371fd36096fd777be7bfe7a2a6%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/c9d5ff20929e8a3c8794facf4c4b326a9c10618812eec356caa20b87%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/f60afd3c7e9ebaaf70fad4a4beb75cf8740ac959017a31e7006c7486%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/r42ac3e39e6265db12d9fc6ae1cd4b5fea7aed9830dc6f6d58228fed7%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/rf7f87810c38dc9abf9f93989f76008f504cbf7c1a355214640b2d04c%40%3Ccommits.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html","https://security.netapp.com/advisory/ntap-20171214-0002/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2017/dsa-4004","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7525","description":"A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qxxx-2pp7-5hmx","versionConstraint":"<=2.6.7.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qxxx-2pp7-5hmx","fix":{"state":"fixed","versions":["2.6.7.1"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"2.6.7.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7525","cwe":"CWE-184","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2017-7525","cwe":"CWE-502","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7525","date":"2026-10-10","epss":0.37721,"percentile":0.98512}],"risk":35.45774,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-7525","https://github.com/FasterXML/jackson-databind/issues/1599","https://github.com/FasterXML/jackson-databind/issues/1723","https://access.redhat.com/errata/RHSA-2017:1834","https://access.redhat.com/errata/RHSA-2017:1835","https://access.redhat.com/errata/RHSA-2017:1836","https://access.redhat.com/errata/RHSA-2017:1837","https://access.redhat.com/errata/RHSA-2017:1839","https://access.redhat.com/errata/RHSA-2017:1840","https://access.redhat.com/errata/RHSA-2017:2477","https://access.redhat.com/errata/RHSA-2017:2546","https://access.redhat.com/errata/RHSA-2017:2547","https://access.redhat.com/errata/RHSA-2017:2633","https://access.redhat.com/errata/RHSA-2017:2635","https://access.redhat.com/errata/RHSA-2017:2636","https://access.redhat.com/errata/RHSA-2017:2637","https://access.redhat.com/errata/RHSA-2017:2638","https://access.redhat.com/errata/RHSA-2017:3141","https://access.redhat.com/errata/RHSA-2017:3454","https://access.redhat.com/errata/RHSA-2017:3455","https://access.redhat.com/errata/RHSA-2017:3456","https://access.redhat.com/errata/RHSA-2017:3458","https://access.redhat.com/errata/RHSA-2018:0294","https://access.redhat.com/errata/RHSA-2018:0342","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2019:0910","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://bugzilla.redhat.com/show_bug.cgi?id=1462702","https://cwiki.apache.org/confluence/display/WW/S2-055","https://lists.apache.org/thread.html/3c87dc8bca99a2b3b4743713b33d1de05b1d6b761fdf316224e9c81f@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/4641ed8616ccc2c1fbddac2c3dc9900c96387bc226eaf0232d61909b@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/5008bcbd45ee65ce39e4220b6ac53d28a24d6bc67d5804e9773a7399@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/b1f33fe5ade396bb903fdcabe9f243f7692c7dfce5418d3743c2d346@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/c10a2bf0fdc3d25faf17bd191d6ec46b29a353fa9c97bebd7c4e5913@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/c2ed4c0126b43e324cf740012a0edd371fd36096fd777be7bfe7a2a6@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/c9d5ff20929e8a3c8794facf4c4b326a9c10618812eec356caa20b87@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/f60afd3c7e9ebaaf70fad4a4beb75cf8740ac959017a31e7006c7486@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589@%3Cissues.spark.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2017/dsa-4004","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","https://lists.apache.org/thread.html/r42ac3e39e6265db12d9fc6ae1cd4b5fea7aed9830dc6f6d58228fed7@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rf7f87810c38dc9abf9f93989f76008f504cbf7c1a355214640b2d04c@%3Ccommits.cassandra.apache.org%3E","https://github.com/FasterXML/jackson-databind/commit/3bfbb835e530055c1941ddf87fde0b08d08dcd38","https://github.com/FasterXML/jackson-databind/commit/60d459cedcf079c6106ae7da2ac562bc32dcabe1","https://github.com/FasterXML/jackson-databind/commit/680d75b011edd67a2d2a2e9980998a968194c2ef","https://github.com/FasterXML/jackson-databind/commit/6ce32ffd18facac6abdbbf559c817b47fcb622c1","https://github.com/FasterXML/jackson-databind/commit/90042692085deeb05ae75c569c9909f7dba24415","https://github.com/FasterXML/jackson-databind/commit/fa87c1ddbe803ebb7295f5c2ebfe38e12f6e6162","https://github.com/FasterXML/jackson-databind/commit/fd8dec2c7fab8b4b4bd60502a0f1d63ec23c24da","https://security.netapp.com/advisory/ntap-20171214-0002"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qxxx-2pp7-5hmx","description":"jackson-databind is vulnerable to a deserialization flaw"},"relatedVulnerabilities":[{"id":"CVE-2017-7525","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7525","cwe":"CWE-184","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2017-7525","cwe":"CWE-502","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7525","date":"2026-10-10","epss":0.37721,"percentile":0.98512}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/99623","http://www.securitytracker.com/id/1039744","http://www.securitytracker.com/id/1039947","http://www.securitytracker.com/id/1040360","https://access.redhat.com/errata/RHSA-2017:1834","https://access.redhat.com/errata/RHSA-2017:1835","https://access.redhat.com/errata/RHSA-2017:1836","https://access.redhat.com/errata/RHSA-2017:1837","https://access.redhat.com/errata/RHSA-2017:1839","https://access.redhat.com/errata/RHSA-2017:1840","https://access.redhat.com/errata/RHSA-2017:2477","https://access.redhat.com/errata/RHSA-2017:2546","https://access.redhat.com/errata/RHSA-2017:2547","https://access.redhat.com/errata/RHSA-2017:2633","https://access.redhat.com/errata/RHSA-2017:2635","https://access.redhat.com/errata/RHSA-2017:2636","https://access.redhat.com/errata/RHSA-2017:2637","https://access.redhat.com/errata/RHSA-2017:2638","https://access.redhat.com/errata/RHSA-2017:3141","https://access.redhat.com/errata/RHSA-2017:3454","https://access.redhat.com/errata/RHSA-2017:3455","https://access.redhat.com/errata/RHSA-2017:3456","https://access.redhat.com/errata/RHSA-2017:3458","https://access.redhat.com/errata/RHSA-2018:0294","https://access.redhat.com/errata/RHSA-2018:0342","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2019:0910","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://bugzilla.redhat.com/show_bug.cgi?id=1462702","https://cwiki.apache.org/confluence/display/WW/S2-055","https://github.com/FasterXML/jackson-databind/issues/1599","https://github.com/FasterXML/jackson-databind/issues/1723","https://lists.apache.org/thread.html/3c87dc8bca99a2b3b4743713b33d1de05b1d6b761fdf316224e9c81f%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/4641ed8616ccc2c1fbddac2c3dc9900c96387bc226eaf0232d61909b%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/5008bcbd45ee65ce39e4220b6ac53d28a24d6bc67d5804e9773a7399%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/b1f33fe5ade396bb903fdcabe9f243f7692c7dfce5418d3743c2d346%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/c10a2bf0fdc3d25faf17bd191d6ec46b29a353fa9c97bebd7c4e5913%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/c2ed4c0126b43e324cf740012a0edd371fd36096fd777be7bfe7a2a6%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/c9d5ff20929e8a3c8794facf4c4b326a9c10618812eec356caa20b87%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/f60afd3c7e9ebaaf70fad4a4beb75cf8740ac959017a31e7006c7486%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/r42ac3e39e6265db12d9fc6ae1cd4b5fea7aed9830dc6f6d58228fed7%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/rf7f87810c38dc9abf9f93989f76008f504cbf7c1a355214640b2d04c%40%3Ccommits.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html","https://security.netapp.com/advisory/ntap-20171214-0002/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2017/dsa-4004","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7525","description":"A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2182","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2182","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2182","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2182","date":"2026-10-10","epss":0.46095,"percentile":0.98782}],"risk":34.571250000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2182"},"relatedVulnerabilities":[{"id":"CVE-2016-2182","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2182","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2182","date":"2026-10-10","epss":0.46095,"percentile":0.98782}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92557","http://www.securitytracker.com/id/1036688","http://www.securitytracker.com/id/1037968","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=07bed46f332fce8c1d157689a2cdf915a982ae34","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://source.android.com/security/bulletin/2017-03-01","https://source.android.com/security/bulletin/2017-03-01.html","https://support.f5.com/csp/article/K01276005","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2182","description":"The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2182","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2182","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2182","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2182","date":"2026-10-10","epss":0.46095,"percentile":0.98782}],"risk":34.571250000000006,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2182"},"relatedVulnerabilities":[{"id":"CVE-2016-2182","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2182","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2182","date":"2026-10-10","epss":0.46095,"percentile":0.98782}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92557","http://www.securitytracker.com/id/1036688","http://www.securitytracker.com/id/1037968","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=07bed46f332fce8c1d157689a2cdf915a982ae34","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://source.android.com/security/bulletin/2017-03-01","https://source.android.com/security/bulletin/2017-03-01.html","https://support.f5.com/csp/article/K01276005","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2182","description":"The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"db8ea562e46a3772","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-8457","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-8457","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-10-10","epss":0.45426,"percentile":0.98762}],"risk":34.0695,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-8457"},"relatedVulnerabilities":[{"id":"CVE-2019-8457","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-10-10","epss":0.45426,"percentile":0.98762}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/","https://security.netapp.com/advisory/ntap-20190606-0002/","https://usn.ubuntu.com/4004-1/","https://usn.ubuntu.com/4004-2/","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.sqlite.org/releaselog/3_28_0.html","https://www.sqlite.org/src/info/90acdbfce9c08858"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-8457","description":"SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2177","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2177","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2177","date":"2026-10-10","epss":0.44505,"percentile":0.98737}],"risk":33.378750000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2177"},"relatedVulnerabilities":[{"id":"CVE-2016-2177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2177","date":"2026-10-10","epss":0.44505,"percentile":0.98737}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.openwall.com/lists/oss-security/2016/06/08/9","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/archive/1/540957/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/540957/100/0/threaded","http://www.securityfocus.com/bid/91319","http://www.securitytracker.com/id/1036088","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","http://www.ubuntu.com/usn/USN-3181-1","https://access.redhat.com/errata/RHSA-2017:0193","https://access.redhat.com/errata/RHSA-2017:0194","https://access.redhat.com/errata/RHSA-2017:1658","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1341705","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=a004e72b95835136d3f1ea90517f706c24c03da7","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03763en_us","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10165","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.f5.com/csp/article/K23873366","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9134-vulnerabilities-within-schneider-electric-floating-license-manager","https://www.schneider-electric.com/en/download/document/SEVD-2018-137-01/","https://www.schneider-electric.com/en/download/document/SEVD-2018-144-01/","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2177","description":"OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2177","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2177","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2177","date":"2026-10-10","epss":0.44505,"percentile":0.98737}],"risk":33.378750000000004,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2177"},"relatedVulnerabilities":[{"id":"CVE-2016-2177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2177","date":"2026-10-10","epss":0.44505,"percentile":0.98737}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.openwall.com/lists/oss-security/2016/06/08/9","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/archive/1/540957/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/540957/100/0/threaded","http://www.securityfocus.com/bid/91319","http://www.securitytracker.com/id/1036088","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","http://www.ubuntu.com/usn/USN-3181-1","https://access.redhat.com/errata/RHSA-2017:0193","https://access.redhat.com/errata/RHSA-2017:0194","https://access.redhat.com/errata/RHSA-2017:1658","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1341705","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=a004e72b95835136d3f1ea90517f706c24c03da7","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03763en_us","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10165","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.f5.com/csp/article/K23873366","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9134-vulnerabilities-within-schneider-electric-floating-license-manager","https://www.schneider-electric.com/en/download/document/SEVD-2018-137-01/","https://www.schneider-electric.com/en/download/document/SEVD-2018-144-01/","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2177","description":"OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c."}]},{"artifact":{"id":"5ee0f988b6436bdb","cpes":["cpe:2.3:a:apache:commons-fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.3.1:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.3.1","type":"java-archive","version":"1.3.1","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-rest-module-2.9.24.jar:commons-fileupload:commons-fileupload","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-rest-module-2.9.24.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.3.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7x9j-7223-rg5m","versionConstraint":"<1.3.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7x9j-7223-rg5m","fix":{"state":"fixed","versions":["1.3.3"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.3.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1000031","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-1000031","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-1000031","date":"2026-10-10","epss":0.33686,"percentile":0.98353}],"risk":31.664839999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-1000031","https://issues.apache.org/jira/browse/FILEUPLOAD-279","https://issues.apache.org/jira/browse/WW-4812","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080@%3Cannounce.apache.org%3E","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/research/tra-2016-12","https://www.tenable.com/security/research/tra-2016-23","https://www.tenable.com/security/research/tra-2016-30","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/93604","http://www.zerodayinitiative.com/advisories/ZDI-16-570/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7x9j-7223-rg5m","description":"Improper Access Control in commons-fileupload"},"relatedVulnerabilities":[{"id":"CVE-2016-1000031","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1000031","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-1000031","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-1000031","date":"2026-10-10","epss":0.33686,"percentile":0.98353}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/93604","http://www.zerodayinitiative.com/advisories/ZDI-16-570/","https://issues.apache.org/jira/browse/FILEUPLOAD-279","https://issues.apache.org/jira/browse/WW-4812","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/research/tra-2016-12","https://www.tenable.com/security/research/tra-2016-23","https://www.tenable.com/security/research/tra-2016-30"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000031","description":"Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution"}]},{"artifact":{"id":"eef380ca8b0cdbdf","cpes":["cpe:2.3:a:apache:commons-fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.3.1:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.3.1","type":"java-archive","version":"1.3.1","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-universal-plugin-manager-plugin-2.18.4.jar:commons-fileupload:commons-fileupload","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-universal-plugin-manager-plugin-2.18.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.3.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7x9j-7223-rg5m","versionConstraint":"<1.3.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7x9j-7223-rg5m","fix":{"state":"fixed","versions":["1.3.3"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.3.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1000031","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-1000031","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-1000031","date":"2026-10-10","epss":0.33686,"percentile":0.98353}],"risk":31.664839999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-1000031","https://issues.apache.org/jira/browse/FILEUPLOAD-279","https://issues.apache.org/jira/browse/WW-4812","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080@%3Cannounce.apache.org%3E","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/research/tra-2016-12","https://www.tenable.com/security/research/tra-2016-23","https://www.tenable.com/security/research/tra-2016-30","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/93604","http://www.zerodayinitiative.com/advisories/ZDI-16-570/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7x9j-7223-rg5m","description":"Improper Access Control in commons-fileupload"},"relatedVulnerabilities":[{"id":"CVE-2016-1000031","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1000031","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-1000031","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-1000031","date":"2026-10-10","epss":0.33686,"percentile":0.98353}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/93604","http://www.zerodayinitiative.com/advisories/ZDI-16-570/","https://issues.apache.org/jira/browse/FILEUPLOAD-279","https://issues.apache.org/jira/browse/WW-4812","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/research/tra-2016-12","https://www.tenable.com/security/research/tra-2016-23","https://www.tenable.com/security/research/tra-2016-30"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000031","description":"Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution"}]},{"artifact":{"id":"82038657ac90fdfa","cpes":["cpe:2.3:a:apache:commons-fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.3.1:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.3.1","type":"java-archive","version":"1.3.1","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-fileupload-1.3.1.jar","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":[{"value":"c621b54583719ac0310404463d6d99db27e1052c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-fileupload-1.3.1.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-fileupload-1.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.3.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7x9j-7223-rg5m","versionConstraint":"<1.3.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7x9j-7223-rg5m","fix":{"state":"fixed","versions":["1.3.3"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.3.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1000031","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-1000031","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-1000031","date":"2026-10-10","epss":0.33686,"percentile":0.98353}],"risk":31.664839999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-1000031","https://issues.apache.org/jira/browse/FILEUPLOAD-279","https://issues.apache.org/jira/browse/WW-4812","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080@%3Cannounce.apache.org%3E","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/research/tra-2016-12","https://www.tenable.com/security/research/tra-2016-23","https://www.tenable.com/security/research/tra-2016-30","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/93604","http://www.zerodayinitiative.com/advisories/ZDI-16-570/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7x9j-7223-rg5m","description":"Improper Access Control in commons-fileupload"},"relatedVulnerabilities":[{"id":"CVE-2016-1000031","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1000031","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-1000031","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-1000031","date":"2026-10-10","epss":0.33686,"percentile":0.98353}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00036.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/93604","http://www.zerodayinitiative.com/advisories/ZDI-16-570/","https://issues.apache.org/jira/browse/FILEUPLOAD-279","https://issues.apache.org/jira/browse/WW-4812","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/d66657323fd25e437face5e84899c8ca404ccd187e81c3f2fa8b6080%40%3Cannounce.apache.org%3E","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/research/tra-2016-12","https://www.tenable.com/security/research/tra-2016-23","https://www.tenable.com/security/research/tra-2016-30"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000031","description":"Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution"}]},{"artifact":{"id":"fad235ec983b8ebe","cpes":["cpe:2.3:a:org.springframework:spring-web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:4.1.6.RELEASE:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@4.1.6.RELEASE","type":"java-archive","version":"4.1.6.RELEASE","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-web-4.1.6.RELEASE.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"960101b25d0ec6f45d550bf92c00de8c6a584e6a","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-web-4.1.6.RELEASE.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-web-4.1.6.RELEASE.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"6.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4wrc-f8pq-fpqp","versionConstraint":"<6.0.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"4.1.6.RELEASE"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4wrc-f8pq-fpqp","fix":{"state":"fixed","versions":["6.0.0"],"available":[{"date":"2022-12-10","kind":"first-observed","version":"6.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1000027","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-1000027","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-1000027","date":"2026-10-10","epss":0.33179,"percentile":0.98334}],"risk":31.18826,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-1000027","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027","https://security-tracker.debian.org/tracker/CVE-2016-1000027","https://www.tenable.com/security/research/tra-2016-20","https://github.com/spring-projects/spring-framework/issues/24434","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-1231625331","https://github.com/spring-projects/spring-framework/commit/5cbe90b2cd91b866a5a9586e460f311860e11cfa","https://support.contrastsecurity.com/hc/en-us/articles/4402400830612-Spring-web-Java-Deserialization-CVE-2016-1000027","https://github.com/spring-projects/spring-framework/issues/21680","https://github.com/spring-projects/spring-framework/commit/2b051b8b321768a4cfef83077db65c6328ffd60f","https://jira.spring.io/browse/SPR-17143?redirect=false","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525","https://security.netapp.com/advisory/ntap-20230420-0009/","https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4wrc-f8pq-fpqp","description":"Pivotal Spring Framework contains unsafe Java deserialization methods"},"relatedVulnerabilities":[{"id":"CVE-2016-1000027","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1000027","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-1000027","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-1000027","date":"2026-10-10","epss":0.33179,"percentile":0.98334}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000027","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-579669626","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-582313417","https://github.com/spring-projects/spring-framework/issues/24434#issuecomment-744519525","https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000027.json","https://security-tracker.debian.org/tracker/CVE-2016-1000027","https://security.netapp.com/advisory/ntap-20230420-0009/","https://spring.io/blog/2022/05/11/spring-framework-5-3-20-and-5-2-22-available-now","https://www.tenable.com/security/research/tra-2016-20"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000027","description":"Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data."}]},{"artifact":{"id":"4751753cd232098c","cpes":["cpe:2.3:a:apache:tomcat-coyote:8.0.23:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_coyote:8.0.23:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*"],"name":"tomcat-coyote","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote@8.0.23","type":"java-archive","version":"8.0.23","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/stash/lib/tomcat-coyote.jar","manifestName":"","pomArtifactID":"tomcat-coyote","archiveDigests":[{"value":"d1602d55eb7e1a6c977ca81bf5da23caba1349d3","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/lib/tomcat-coyote.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/lib/tomcat-coyote.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.0.39"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jc7p-5r39-9477","versionConstraint":">=8.0.0RC1,<8.0.39 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-coyote","version":"8.0.23"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jc7p-5r39-9477","fix":{"state":"fixed","versions":["8.0.39"],"available":[{"date":"2023-09-27","kind":"first-observed","version":"8.0.39"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","metrics":{"baseScore":7.1,"impactScore":3.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6816","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6816","date":"2026-10-10","epss":0.39633,"percentile":0.98586}],"risk":28.93209,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-6816","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://access.redhat.com/errata/RHSA-2017:0935","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E","https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48","https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73","https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39","https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.0.M13","http://rhn.redhat.com/errata/RHSA-2017-0244.html","http://rhn.redhat.com/errata/RHSA-2017-0245.html","http://rhn.redhat.com/errata/RHSA-2017-0246.html","http://rhn.redhat.com/errata/RHSA-2017-0247.html","http://rhn.redhat.com/errata/RHSA-2017-0250.html","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://rhn.redhat.com/errata/RHSA-2017-0527.html","http://www.debian.org/security/2016/dsa-3738","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","https://svn.apache.org/viewvc?view=revision&revision=1767641","https://svn.apache.org/viewvc?view=revision&revision=1767645","https://svn.apache.org/viewvc?view=revision&revision=1767653","https://svn.apache.org/viewvc?view=revision&revision=1767675","https://svn.apache.org/viewvc?view=revision&revision=1767683","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://web.archive.org/web/20161204121236/http://www.securityfocus.com/bid/94461","https://web.archive.org/web/20170929085438/http://www.securitytracker.com/id/1037332","https://github.com/apache/tomcat/commit/516bda676ac8d0284da3e0295a7df70391315360","https://github.com/apache/tomcat/commit/cdc0a935c2173aff60039a0b85e57a461381107c","https://github.com/apache/tomcat/commit/f96f5751d418ae5a2f550be040daf9c5f7d99256","https://github.com/apache/tomcat80/commit/779d5d34e68e50d2f721897050b147106992f566","https://security.netapp.com/advisory/ntap-20180607-0001","https://usn.ubuntu.com/4557-1","https://www.exploit-db.com/exploits/41783"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jc7p-5r39-9477","description":"Improper Input Validation in Apache Tomcat"},"relatedVulnerabilities":[{"id":"CVE-2016-6816","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","metrics":{"baseScore":7.1,"impactScore":3.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6816","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6816","date":"2026-10-10","epss":0.39633,"percentile":0.98586}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0244.html","http://rhn.redhat.com/errata/RHSA-2017-0245.html","http://rhn.redhat.com/errata/RHSA-2017-0246.html","http://rhn.redhat.com/errata/RHSA-2017-0247.html","http://rhn.redhat.com/errata/RHSA-2017-0250.html","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://rhn.redhat.com/errata/RHSA-2017-0527.html","http://www.debian.org/security/2016/dsa-3738","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/94461","http://www.securitytracker.com/id/1037332","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://access.redhat.com/errata/RHSA-2017:0935","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.netapp.com/advisory/ntap-20180607-0001/","https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48","https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73","https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39","https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.8","https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.0.M13","https://usn.ubuntu.com/4557-1/","https://www.exploit-db.com/exploits/41783/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6816","description":"The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3731","versionConstraint":"< 1.0.1t-1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-3731","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3731","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3731","date":"2026-10-10","epss":0.57322,"percentile":0.99059}],"risk":28.660999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3773-1","link":"https://security-tracker.debian.org/tracker/DSA-3773-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-3731"},"relatedVulnerabilities":[{"id":"CVE-2017-3731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3731","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3731","date":"2026-10-10","epss":0.57322,"percentile":0.99059}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0286.html","http://www.debian.org/security/2017/dsa-3773","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/95813","http://www.securitytracker.com/id/1037717","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc","https://security.gentoo.org/glsa/201702-07","https://security.netapp.com/advisory/ntap-20171019-0002/","https://security.paloaltonetworks.com/CVE-2017-3731","https://source.android.com/security/bulletin/pixel/2017-11-01","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us","https://www.openssl.org/news/secadv/20170126.txt","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.tenable.com/security/tns-2017-04"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3731","description":"If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-3731","versionConstraint":"< 1.0.1t-1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-3731","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3731","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3731","date":"2026-10-10","epss":0.57322,"percentile":0.99059}],"risk":28.660999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3773-1","link":"https://security-tracker.debian.org/tracker/DSA-3773-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-3731"},"relatedVulnerabilities":[{"id":"CVE-2017-3731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3731","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3731","date":"2026-10-10","epss":0.57322,"percentile":0.99059}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0286.html","http://www.debian.org/security/2017/dsa-3773","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/95813","http://www.securitytracker.com/id/1037717","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc","https://security.gentoo.org/glsa/201702-07","https://security.netapp.com/advisory/ntap-20171019-0002/","https://security.paloaltonetworks.com/CVE-2017-3731","https://source.android.com/security/bulletin/pixel/2017-11-01","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us","https://www.openssl.org/news/secadv/20170126.txt","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.tenable.com/security/tns-2017-04"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3731","description":"If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k."}]},{"artifact":{"id":"82038657ac90fdfa","cpes":["cpe:2.3:a:apache:commons-fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.3.1:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.3.1","type":"java-archive","version":"1.3.1","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-fileupload-1.3.1.jar","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":[{"value":"c621b54583719ac0310404463d6d99db27e1052c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-fileupload-1.3.1.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-fileupload-1.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fvm3-cfvj-gxqq","versionConstraint":"<1.3.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fvm3-cfvj-gxqq","fix":{"state":"fixed","versions":["1.3.2"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3092","date":"2026-10-10","epss":0.37171,"percentile":0.9849}],"risk":27.878249999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-3092","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://bugzilla.redhat.com/show_bug.cgi?id=1349468","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","http://jvn.jp/en/jp/JVN89379547/index.html","http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121","http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html","http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E","http://rhn.redhat.com/errata/RHSA-2016-2068.html","http://rhn.redhat.com/errata/RHSA-2016-2069.html","http://rhn.redhat.com/errata/RHSA-2016-2070.html","http://rhn.redhat.com/errata/RHSA-2016-2071.html","http://rhn.redhat.com/errata/RHSA-2016-2072.html","http://rhn.redhat.com/errata/RHSA-2016-2599.html","http://rhn.redhat.com/errata/RHSA-2016-2807.html","http://rhn.redhat.com/errata/RHSA-2016-2808.html","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://svn.apache.org/viewvc?view=revision&revision=1743480","http://svn.apache.org/viewvc?view=revision&revision=1743722","http://svn.apache.org/viewvc?view=revision&revision=1743738","http://svn.apache.org/viewvc?view=revision&revision=1743742","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.debian.org/security/2016/dsa-3609","http://www.debian.org/security/2016/dsa-3611","http://www.debian.org/security/2016/dsa-3614","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.ubuntu.com/usn/USN-3024-1","http://www.ubuntu.com/usn/USN-3027-1","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/202107-39","https://web.archive.org/web/20160726114129/http://www.securitytracker.com/id/1036427","https://web.archive.org/web/20160924080828/http://www.securityfocus.com/bid/91453","https://web.archive.org/web/20170317103106/http://www.securitytracker.com/id/1037029","https://web.archive.org/web/20171103224941/http://www.securitytracker.com/id/1036900","https://web.archive.org/web/20171111060434/http://www.securitytracker.com/id/1039606"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fvm3-cfvj-gxqq","description":"High severity vulnerability that affects commons-fileupload:commons-fileupload"},"relatedVulnerabilities":[{"id":"CVE-2016-3092","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3092","date":"2026-10-10","epss":0.37171,"percentile":0.9849}],"urls":["http://jvn.jp/en/jp/JVN89379547/index.html","http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121","http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html","http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E","http://rhn.redhat.com/errata/RHSA-2016-2068.html","http://rhn.redhat.com/errata/RHSA-2016-2069.html","http://rhn.redhat.com/errata/RHSA-2016-2070.html","http://rhn.redhat.com/errata/RHSA-2016-2071.html","http://rhn.redhat.com/errata/RHSA-2016-2072.html","http://rhn.redhat.com/errata/RHSA-2016-2599.html","http://rhn.redhat.com/errata/RHSA-2016-2807.html","http://rhn.redhat.com/errata/RHSA-2016-2808.html","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://svn.apache.org/viewvc?view=revision&revision=1743480","http://svn.apache.org/viewvc?view=revision&revision=1743722","http://svn.apache.org/viewvc?view=revision&revision=1743738","http://svn.apache.org/viewvc?view=revision&revision=1743742","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.debian.org/security/2016/dsa-3609","http://www.debian.org/security/2016/dsa-3611","http://www.debian.org/security/2016/dsa-3614","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91453","http://www.securitytracker.com/id/1036427","http://www.securitytracker.com/id/1036900","http://www.securitytracker.com/id/1037029","http://www.securitytracker.com/id/1039606","http://www.ubuntu.com/usn/USN-3024-1","http://www.ubuntu.com/usn/USN-3027-1","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://bugzilla.redhat.com/show_bug.cgi?id=1349468","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.gentoo.org/glsa/202107-39","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3092","description":"The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string."}]},{"artifact":{"id":"5ee0f988b6436bdb","cpes":["cpe:2.3:a:apache:commons-fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.3.1:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.3.1","type":"java-archive","version":"1.3.1","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-rest-module-2.9.24.jar:commons-fileupload:commons-fileupload","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-rest-module-2.9.24.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fvm3-cfvj-gxqq","versionConstraint":"<1.3.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fvm3-cfvj-gxqq","fix":{"state":"fixed","versions":["1.3.2"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3092","date":"2026-10-10","epss":0.37171,"percentile":0.9849}],"risk":27.878249999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-3092","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://bugzilla.redhat.com/show_bug.cgi?id=1349468","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","http://jvn.jp/en/jp/JVN89379547/index.html","http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121","http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html","http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E","http://rhn.redhat.com/errata/RHSA-2016-2068.html","http://rhn.redhat.com/errata/RHSA-2016-2069.html","http://rhn.redhat.com/errata/RHSA-2016-2070.html","http://rhn.redhat.com/errata/RHSA-2016-2071.html","http://rhn.redhat.com/errata/RHSA-2016-2072.html","http://rhn.redhat.com/errata/RHSA-2016-2599.html","http://rhn.redhat.com/errata/RHSA-2016-2807.html","http://rhn.redhat.com/errata/RHSA-2016-2808.html","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://svn.apache.org/viewvc?view=revision&revision=1743480","http://svn.apache.org/viewvc?view=revision&revision=1743722","http://svn.apache.org/viewvc?view=revision&revision=1743738","http://svn.apache.org/viewvc?view=revision&revision=1743742","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.debian.org/security/2016/dsa-3609","http://www.debian.org/security/2016/dsa-3611","http://www.debian.org/security/2016/dsa-3614","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.ubuntu.com/usn/USN-3024-1","http://www.ubuntu.com/usn/USN-3027-1","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/202107-39","https://web.archive.org/web/20160726114129/http://www.securitytracker.com/id/1036427","https://web.archive.org/web/20160924080828/http://www.securityfocus.com/bid/91453","https://web.archive.org/web/20170317103106/http://www.securitytracker.com/id/1037029","https://web.archive.org/web/20171103224941/http://www.securitytracker.com/id/1036900","https://web.archive.org/web/20171111060434/http://www.securitytracker.com/id/1039606"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fvm3-cfvj-gxqq","description":"High severity vulnerability that affects commons-fileupload:commons-fileupload"},"relatedVulnerabilities":[{"id":"CVE-2016-3092","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3092","date":"2026-10-10","epss":0.37171,"percentile":0.9849}],"urls":["http://jvn.jp/en/jp/JVN89379547/index.html","http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121","http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html","http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E","http://rhn.redhat.com/errata/RHSA-2016-2068.html","http://rhn.redhat.com/errata/RHSA-2016-2069.html","http://rhn.redhat.com/errata/RHSA-2016-2070.html","http://rhn.redhat.com/errata/RHSA-2016-2071.html","http://rhn.redhat.com/errata/RHSA-2016-2072.html","http://rhn.redhat.com/errata/RHSA-2016-2599.html","http://rhn.redhat.com/errata/RHSA-2016-2807.html","http://rhn.redhat.com/errata/RHSA-2016-2808.html","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://svn.apache.org/viewvc?view=revision&revision=1743480","http://svn.apache.org/viewvc?view=revision&revision=1743722","http://svn.apache.org/viewvc?view=revision&revision=1743738","http://svn.apache.org/viewvc?view=revision&revision=1743742","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.debian.org/security/2016/dsa-3609","http://www.debian.org/security/2016/dsa-3611","http://www.debian.org/security/2016/dsa-3614","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91453","http://www.securitytracker.com/id/1036427","http://www.securitytracker.com/id/1036900","http://www.securitytracker.com/id/1037029","http://www.securitytracker.com/id/1039606","http://www.ubuntu.com/usn/USN-3024-1","http://www.ubuntu.com/usn/USN-3027-1","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://bugzilla.redhat.com/show_bug.cgi?id=1349468","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.gentoo.org/glsa/202107-39","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3092","description":"The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string."}]},{"artifact":{"id":"eef380ca8b0cdbdf","cpes":["cpe:2.3:a:apache:commons-fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.3.1:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.3.1","type":"java-archive","version":"1.3.1","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-universal-plugin-manager-plugin-2.18.4.jar:commons-fileupload:commons-fileupload","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-universal-plugin-manager-plugin-2.18.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fvm3-cfvj-gxqq","versionConstraint":"<1.3.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fvm3-cfvj-gxqq","fix":{"state":"fixed","versions":["1.3.2"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3092","date":"2026-10-10","epss":0.37171,"percentile":0.9849}],"risk":27.878249999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-3092","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://bugzilla.redhat.com/show_bug.cgi?id=1349468","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","http://jvn.jp/en/jp/JVN89379547/index.html","http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121","http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html","http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E","http://rhn.redhat.com/errata/RHSA-2016-2068.html","http://rhn.redhat.com/errata/RHSA-2016-2069.html","http://rhn.redhat.com/errata/RHSA-2016-2070.html","http://rhn.redhat.com/errata/RHSA-2016-2071.html","http://rhn.redhat.com/errata/RHSA-2016-2072.html","http://rhn.redhat.com/errata/RHSA-2016-2599.html","http://rhn.redhat.com/errata/RHSA-2016-2807.html","http://rhn.redhat.com/errata/RHSA-2016-2808.html","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://svn.apache.org/viewvc?view=revision&revision=1743480","http://svn.apache.org/viewvc?view=revision&revision=1743722","http://svn.apache.org/viewvc?view=revision&revision=1743738","http://svn.apache.org/viewvc?view=revision&revision=1743742","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.debian.org/security/2016/dsa-3609","http://www.debian.org/security/2016/dsa-3611","http://www.debian.org/security/2016/dsa-3614","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.ubuntu.com/usn/USN-3024-1","http://www.ubuntu.com/usn/USN-3027-1","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/202107-39","https://web.archive.org/web/20160726114129/http://www.securitytracker.com/id/1036427","https://web.archive.org/web/20160924080828/http://www.securityfocus.com/bid/91453","https://web.archive.org/web/20170317103106/http://www.securitytracker.com/id/1037029","https://web.archive.org/web/20171103224941/http://www.securitytracker.com/id/1036900","https://web.archive.org/web/20171111060434/http://www.securitytracker.com/id/1039606"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fvm3-cfvj-gxqq","description":"High severity vulnerability that affects commons-fileupload:commons-fileupload"},"relatedVulnerabilities":[{"id":"CVE-2016-3092","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3092","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3092","date":"2026-10-10","epss":0.37171,"percentile":0.9849}],"urls":["http://jvn.jp/en/jp/JVN89379547/index.html","http://jvndb.jvn.jp/jvndb/JVNDB-2016-000121","http://lists.opensuse.org/opensuse-updates/2016-09/msg00025.html","http://mail-archives.apache.org/mod_mbox/commons-dev/201606.mbox/%3CCAF8HOZ%2BPq2QH8RnxBuJyoK1dOz6jrTiQypAC%2BH8g6oZkBg%2BCxg%40mail.gmail.com%3E","http://rhn.redhat.com/errata/RHSA-2016-2068.html","http://rhn.redhat.com/errata/RHSA-2016-2069.html","http://rhn.redhat.com/errata/RHSA-2016-2070.html","http://rhn.redhat.com/errata/RHSA-2016-2071.html","http://rhn.redhat.com/errata/RHSA-2016-2072.html","http://rhn.redhat.com/errata/RHSA-2016-2599.html","http://rhn.redhat.com/errata/RHSA-2016-2807.html","http://rhn.redhat.com/errata/RHSA-2016-2808.html","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://svn.apache.org/viewvc?view=revision&revision=1743480","http://svn.apache.org/viewvc?view=revision&revision=1743722","http://svn.apache.org/viewvc?view=revision&revision=1743738","http://svn.apache.org/viewvc?view=revision&revision=1743742","http://tomcat.apache.org/security-7.html","http://tomcat.apache.org/security-8.html","http://tomcat.apache.org/security-9.html","http://www.debian.org/security/2016/dsa-3609","http://www.debian.org/security/2016/dsa-3611","http://www.debian.org/security/2016/dsa-3614","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91453","http://www.securitytracker.com/id/1036427","http://www.securitytracker.com/id/1036900","http://www.securitytracker.com/id/1037029","http://www.securitytracker.com/id/1039606","http://www.ubuntu.com/usn/USN-3024-1","http://www.ubuntu.com/usn/USN-3027-1","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://bugzilla.redhat.com/show_bug.cgi?id=1349468","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05204371","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289840","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324759","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.gentoo.org/glsa/202107-39","https://security.netapp.com/advisory/ntap-20190212-0001/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3092","description":"The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string."}]},{"artifact":{"id":"7eaafe3de0d9d3c6","cpes":["cpe:2.3:a:wget:wget:1.16-1:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/debian/wget@1.16-1?arch=amd64&distro=debian-8.5","type":"deb","version":"1.16-1","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16-1+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-13090","versionConstraint":"< 1.16-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"wget","version":"1.16-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-13090","fix":{"state":"fixed","versions":["1.16-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.16-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-13090","cwe":"CWE-122","type":"Secondary","source":"cret@cert.org"},{"cve":"CVE-2017-13090","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13090","date":"2026-10-10","epss":0.36563,"percentile":0.98465}],"risk":27.422250000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4008-1","link":"https://security-tracker.debian.org/tracker/DSA-4008-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-13090"},"relatedVulnerabilities":[{"id":"CVE-2017-13090","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"cret@cert.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-13090","cwe":"CWE-122","type":"Secondary","source":"cret@cert.org"},{"cve":"CVE-2017-13090","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-13090","date":"2026-10-10","epss":0.36563,"percentile":0.98465}],"urls":["http://git.savannah.gnu.org/cgit/wget.git/commit/?id=ba6b44f6745b14dce414761a8e4b35d31b176bba","http://www.debian.org/security/2017/dsa-4008","http://www.securityfocus.com/bid/101590","http://www.securitytracker.com/id/1039661","https://access.redhat.com/errata/RHSA-2017:3075","https://security.gentoo.org/glsa/201711-06","https://www.synology.com/support/security/Synology_SA_17_62_Wget","https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2017/haavoittuvuus-2017-037.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-13090","description":"The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer."}]},{"artifact":{"id":"1b0f8262f0bac2cd","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-14867","versionConstraint":"< 1:2.1.4-2.1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14867","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-14867","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14867","date":"2026-10-10","epss":0.36003,"percentile":0.98442}],"risk":27.00225,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3984-1","link":"https://security-tracker.debian.org/tracker/DSA-3984-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14867"},"relatedVulnerabilities":[{"id":"CVE-2017-14867","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14867","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14867","date":"2026-10-10","epss":0.36003,"percentile":0.98442}],"urls":["http://www.openwall.com/lists/oss-security/2017/09/26/9","http://www.securityfocus.com/bid/101060","http://www.securitytracker.com/id/1039431","https://bugs.debian.org/876854","https://lists.debian.org/debian-security-announce/2017/msg00246.html","https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u","https://www.debian.org/security/2017/dsa-3984"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14867","description":"Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support."}]},{"artifact":{"id":"c887d301ab2f172c","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u2?arch=all&distro=debian-8.5&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-14867","versionConstraint":"< 1:2.1.4-2.1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14867","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-14867","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14867","date":"2026-10-10","epss":0.36003,"percentile":0.98442}],"risk":27.00225,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3984-1","link":"https://security-tracker.debian.org/tracker/DSA-3984-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14867"},"relatedVulnerabilities":[{"id":"CVE-2017-14867","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14867","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14867","date":"2026-10-10","epss":0.36003,"percentile":0.98442}],"urls":["http://www.openwall.com/lists/oss-security/2017/09/26/9","http://www.securityfocus.com/bid/101060","http://www.securitytracker.com/id/1039431","https://bugs.debian.org/876854","https://lists.debian.org/debian-security-announce/2017/msg00246.html","https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u","https://www.debian.org/security/2017/dsa-3984"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14867","description":"Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support."}]},{"artifact":{"id":"82038657ac90fdfa","cpes":["cpe:2.3:a:apache:commons-fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.3.1:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.3.1","type":"java-archive","version":"1.3.1","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-fileupload-1.3.1.jar","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":[{"value":"c621b54583719ac0310404463d6d99db27e1052c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-fileupload-1.3.1.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-fileupload-1.3.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vv7r-c36w-3prj","versionConstraint":">=1.0,<1.6.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vv7r-c36w-3prj","fix":{"state":"fixed","versions":["1.6.0"],"available":[{"date":"2025-07-10","kind":"first-observed","version":"1.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-10-10","epss":0.32964,"percentile":0.98326}],"risk":26.70084,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48976","https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","https://github.com/apache/commons-fileupload/commit/bf68f63cfb312ef4710fb3dfb4d8e4e1665f4497","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://github.com/apache/tomcat/commit/97790a35a27d236fa053e660676c3f8196284d93","https://github.com/apache/commons-fileupload/commit/b247774a72a044f5d5380ae947140ee80af4e78b","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vv7r-c36w-3prj","description":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers"},"relatedVulnerabilities":[{"id":"CVE-2025-48976","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-10-10","epss":0.32964,"percentile":0.98326}],"urls":["https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48976","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue."}]},{"artifact":{"id":"5ee0f988b6436bdb","cpes":["cpe:2.3:a:apache:commons-fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.3.1:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.3.1","type":"java-archive","version":"1.3.1","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-rest-module-2.9.24.jar:commons-fileupload:commons-fileupload","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-rest-module-2.9.24.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vv7r-c36w-3prj","versionConstraint":">=1.0,<1.6.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vv7r-c36w-3prj","fix":{"state":"fixed","versions":["1.6.0"],"available":[{"date":"2025-07-10","kind":"first-observed","version":"1.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-10-10","epss":0.32964,"percentile":0.98326}],"risk":26.70084,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48976","https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","https://github.com/apache/commons-fileupload/commit/bf68f63cfb312ef4710fb3dfb4d8e4e1665f4497","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://github.com/apache/tomcat/commit/97790a35a27d236fa053e660676c3f8196284d93","https://github.com/apache/commons-fileupload/commit/b247774a72a044f5d5380ae947140ee80af4e78b","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vv7r-c36w-3prj","description":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers"},"relatedVulnerabilities":[{"id":"CVE-2025-48976","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-10-10","epss":0.32964,"percentile":0.98326}],"urls":["https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48976","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue."}]},{"artifact":{"id":"eef380ca8b0cdbdf","cpes":["cpe:2.3:a:apache:commons-fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_fileupload:1.3.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.3.1:*:*:*:*:*:*:*"],"name":"commons-fileupload","purl":"pkg:maven/commons-fileupload/commons-fileupload@1.3.1","type":"java-archive","version":"1.3.1","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-fileupload","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-universal-plugin-manager-plugin-2.18.4.jar:commons-fileupload:commons-fileupload","manifestName":"","pomArtifactID":"commons-fileupload","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-universal-plugin-manager-plugin-2.18.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.6.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vv7r-c36w-3prj","versionConstraint":">=1.0,<1.6.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-fileupload:commons-fileupload","version":"1.3.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vv7r-c36w-3prj","fix":{"state":"fixed","versions":["1.6.0"],"available":[{"date":"2025-07-10","kind":"first-observed","version":"1.6.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-10-10","epss":0.32964,"percentile":0.98326}],"risk":26.70084,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-48976","https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","https://github.com/apache/commons-fileupload/commit/bf68f63cfb312ef4710fb3dfb4d8e4e1665f4497","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://github.com/apache/tomcat/commit/97790a35a27d236fa053e660676c3f8196284d93","https://github.com/apache/commons-fileupload/commit/b247774a72a044f5d5380ae947140ee80af4e78b","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vv7r-c36w-3prj","description":"Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers"},"relatedVulnerabilities":[{"id":"CVE-2025-48976","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-48976","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-48976","date":"2026-10-10","epss":0.32964,"percentile":0.98326}],"urls":["https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","http://www.openwall.com/lists/oss-security/2025/06/16/4","https://lists.debian.org/debian-lts-announce/2025/07/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48976","description":"Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue."}]},{"artifact":{"id":"1b0f8262f0bac2cd","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1349","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1349","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-10-10","epss":0.34007,"percentile":0.98365}],"risk":25.50525,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1349"},"relatedVulnerabilities":[{"id":"CVE-2019-1349","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-10-10","epss":0.34007,"percentile":0.98365}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1349","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"c887d301ab2f172c","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u2?arch=all&distro=debian-8.5&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1349","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1349","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-10-10","epss":0.34007,"percentile":0.98365}],"risk":25.50525,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1349"},"relatedVulnerabilities":[{"id":"CVE-2019-1349","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1349","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1349","date":"2026-10-10","epss":0.34007,"percentile":0.98365}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1349","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4w82-r329-3q67","versionConstraint":">=2.0.0,<=2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4w82-r329-3q67","fix":{"state":"fixed","versions":["2.6.7.4"],"available":[{"date":"2022-04-08","kind":"first-observed","version":"2.6.7.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8840","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8840","date":"2026-10-10","epss":0.26587,"percentile":0.97978}],"risk":24.991780000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-8840","https://github.com/FasterXML/jackson-databind/issues/2620","https://github.com/FasterXML/jackson-databind/commit/914e7c9f2cb8ce66724bf26a72adc7e958992497","https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41db6db@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022fb46f007dd00d3@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c54160076408574e1da@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582449fac1704bde2@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe7620169d16db78e9c71@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r46bebdeb59b8b7212d63a010ca445a9f5c4e9d64dcf693cab6f399d3@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6fdd4c61a09a0c89f581b4ddb3dc6f154ab0c705fcfd0a7358b2e4e5@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8170007fd9b263d65b37d92a7b5d7bc357aedbb113a32838bc4a9485@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9ecf211c22760b00967ebe158c6ed7dba9142078e2a630ab8904a5b7@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rac5ee5d686818be7e7c430d35108ee01a88aae54f832d32f62431fd1@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb43f9a65150948a6bebd3cb77ee3e105d40db2820fd547528f4e7f89@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb5eedf90ba3633e171a2ffdfe484651c9490dc5df74c8a29244cbc0e@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdf8d389271a291dde3b2f99c36918d6cb1e796958af626cc140fee23@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re7326b8655eab931f2a9ce074fd9a1a51b5db11456bee9b48e1e170c@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re8ae2670ec456ef1c5a2a661a2838ab2cd00e9efa1e88c069f546f21@%3Ccommits.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html","https://lists.apache.org/thread.html/r65ee95fa09c831843bac81eaa582fdddc2b6119912a72d1c83a9b882@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fce36f96fe3d8218@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b01408a39c8d1ab9e0e@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe879caae5c98b7657@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cdfbf844ca395cec@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r5d8bea8e9d17b6efcf4a0e4e194e91ef46a99f505777a31a60da2b38@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r7762d69e85c58d6948823424017ef4c08f47de077644277fa18cc116@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220@%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r94930e39b60fff236160c1c4110fe884dc093044b067aa5fc98d7ee1@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r9e59ebaf76fd00b2fa3ff5ebf18fe075ca9f4376216612c696f76718@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/ra275f29615f35d5b40106d1582a41e5388b2a5131564e9e01a572987@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rb73708bf714ed6dbc1212da082e7703e586077f0c92f3940b2e82caf@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rb99c7321eba5d4c907beec46675d52827528b738cfafd48eb4d862f1@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rc717fd6c65190f4e592345713f9ef0723fb7d71f624caa2a17caa26a@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcc72b497e3dff2dc62ec9b89ceb90bc4e1b14fc56c3c252a6fcbb013@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rdea588d4a0ebf9cb7ce8c3a8f18d0d306507c4f8ba178dd3d20207b8@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rdf311f13e6356297e0ffe74397fdd25a3687b0a16e687c3ff5b834d8@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rf28ab6f224b48452afd567dfffb705fbda0fdbbf6535f6bc69d47e91@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfc1ccfe89332155b72ce17f13a2701d3e7b9ec213324ceb90e79a28a@%3Cdev.ranger.apache.org%3E","https://security.netapp.com/advisory/ntap-20200327-0002/","https://www.oracle.com/security-alerts/cpuapr2020.html","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/74aba4042fce35ee0b91bd2847e788c10040d78b","https://github.com/FasterXML/jackson-databind/commit/9bb52c7122271df75435ec7e66ecf6b02b1ee14f"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4w82-r329-3q67","description":"Deserialization of Untrusted Data in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-8840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8840","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8840","date":"2026-10-10","epss":0.26587,"percentile":0.97978}],"urls":["http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en","https://github.com/FasterXML/jackson-databind/issues/2620","https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41db6db%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fce36f96fe3d8218%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b01408a39c8d1ab9e0e%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe879caae5c98b7657%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022fb46f007dd00d3%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c54160076408574e1da%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582449fac1704bde2%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe7620169d16db78e9c71%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cdfbf844ca395cec%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r46bebdeb59b8b7212d63a010ca445a9f5c4e9d64dcf693cab6f399d3%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5d8bea8e9d17b6efcf4a0e4e194e91ef46a99f505777a31a60da2b38%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r65ee95fa09c831843bac81eaa582fdddc2b6119912a72d1c83a9b882%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6fdd4c61a09a0c89f581b4ddb3dc6f154ab0c705fcfd0a7358b2e4e5%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7762d69e85c58d6948823424017ef4c08f47de077644277fa18cc116%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r8170007fd9b263d65b37d92a7b5d7bc357aedbb113a32838bc4a9485%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r94930e39b60fff236160c1c4110fe884dc093044b067aa5fc98d7ee1%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r9e59ebaf76fd00b2fa3ff5ebf18fe075ca9f4376216612c696f76718%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r9ecf211c22760b00967ebe158c6ed7dba9142078e2a630ab8904a5b7%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra275f29615f35d5b40106d1582a41e5388b2a5131564e9e01a572987%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rac5ee5d686818be7e7c430d35108ee01a88aae54f832d32f62431fd1%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb43f9a65150948a6bebd3cb77ee3e105d40db2820fd547528f4e7f89%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb5eedf90ba3633e171a2ffdfe484651c9490dc5df74c8a29244cbc0e%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb73708bf714ed6dbc1212da082e7703e586077f0c92f3940b2e82caf%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rb99c7321eba5d4c907beec46675d52827528b738cfafd48eb4d862f1%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rc717fd6c65190f4e592345713f9ef0723fb7d71f624caa2a17caa26a%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcc72b497e3dff2dc62ec9b89ceb90bc4e1b14fc56c3c252a6fcbb013%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rdea588d4a0ebf9cb7ce8c3a8f18d0d306507c4f8ba178dd3d20207b8%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rdf311f13e6356297e0ffe74397fdd25a3687b0a16e687c3ff5b834d8%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rdf8d389271a291dde3b2f99c36918d6cb1e796958af626cc140fee23%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re7326b8655eab931f2a9ce074fd9a1a51b5db11456bee9b48e1e170c%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re8ae2670ec456ef1c5a2a661a2838ab2cd00e9efa1e88c069f546f21%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/rf28ab6f224b48452afd567dfffb705fbda0fdbbf6535f6bc69d47e91%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfc1ccfe89332155b72ce17f13a2701d3e7b9ec213324ceb90e79a28a%40%3Cdev.ranger.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html","https://security.netapp.com/advisory/ntap-20200327-0002/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8840","description":"FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4w82-r329-3q67","versionConstraint":">=2.0.0,<=2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4w82-r329-3q67","fix":{"state":"fixed","versions":["2.6.7.4"],"available":[{"date":"2022-04-08","kind":"first-observed","version":"2.6.7.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8840","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8840","date":"2026-10-10","epss":0.26587,"percentile":0.97978}],"risk":24.991780000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-8840","https://github.com/FasterXML/jackson-databind/issues/2620","https://github.com/FasterXML/jackson-databind/commit/914e7c9f2cb8ce66724bf26a72adc7e958992497","https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41db6db@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022fb46f007dd00d3@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c54160076408574e1da@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582449fac1704bde2@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe7620169d16db78e9c71@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r46bebdeb59b8b7212d63a010ca445a9f5c4e9d64dcf693cab6f399d3@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6fdd4c61a09a0c89f581b4ddb3dc6f154ab0c705fcfd0a7358b2e4e5@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8170007fd9b263d65b37d92a7b5d7bc357aedbb113a32838bc4a9485@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9ecf211c22760b00967ebe158c6ed7dba9142078e2a630ab8904a5b7@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rac5ee5d686818be7e7c430d35108ee01a88aae54f832d32f62431fd1@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb43f9a65150948a6bebd3cb77ee3e105d40db2820fd547528f4e7f89@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb5eedf90ba3633e171a2ffdfe484651c9490dc5df74c8a29244cbc0e@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdf8d389271a291dde3b2f99c36918d6cb1e796958af626cc140fee23@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re7326b8655eab931f2a9ce074fd9a1a51b5db11456bee9b48e1e170c@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re8ae2670ec456ef1c5a2a661a2838ab2cd00e9efa1e88c069f546f21@%3Ccommits.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html","https://lists.apache.org/thread.html/r65ee95fa09c831843bac81eaa582fdddc2b6119912a72d1c83a9b882@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fce36f96fe3d8218@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b01408a39c8d1ab9e0e@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe879caae5c98b7657@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cdfbf844ca395cec@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r5d8bea8e9d17b6efcf4a0e4e194e91ef46a99f505777a31a60da2b38@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r7762d69e85c58d6948823424017ef4c08f47de077644277fa18cc116@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220@%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1@%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r94930e39b60fff236160c1c4110fe884dc093044b067aa5fc98d7ee1@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r9e59ebaf76fd00b2fa3ff5ebf18fe075ca9f4376216612c696f76718@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/ra275f29615f35d5b40106d1582a41e5388b2a5131564e9e01a572987@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rb73708bf714ed6dbc1212da082e7703e586077f0c92f3940b2e82caf@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rb99c7321eba5d4c907beec46675d52827528b738cfafd48eb4d862f1@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rc717fd6c65190f4e592345713f9ef0723fb7d71f624caa2a17caa26a@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcc72b497e3dff2dc62ec9b89ceb90bc4e1b14fc56c3c252a6fcbb013@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rdea588d4a0ebf9cb7ce8c3a8f18d0d306507c4f8ba178dd3d20207b8@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rdf311f13e6356297e0ffe74397fdd25a3687b0a16e687c3ff5b834d8@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rf28ab6f224b48452afd567dfffb705fbda0fdbbf6535f6bc69d47e91@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfc1ccfe89332155b72ce17f13a2701d3e7b9ec213324ceb90e79a28a@%3Cdev.ranger.apache.org%3E","https://security.netapp.com/advisory/ntap-20200327-0002/","https://www.oracle.com/security-alerts/cpuapr2020.html","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/74aba4042fce35ee0b91bd2847e788c10040d78b","https://github.com/FasterXML/jackson-databind/commit/9bb52c7122271df75435ec7e66ecf6b02b1ee14f"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4w82-r329-3q67","description":"Deserialization of Untrusted Data in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-8840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8840","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8840","date":"2026-10-10","epss":0.26587,"percentile":0.97978}],"urls":["http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en","https://github.com/FasterXML/jackson-databind/issues/2620","https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41db6db%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fce36f96fe3d8218%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b01408a39c8d1ab9e0e%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe879caae5c98b7657%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022fb46f007dd00d3%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c54160076408574e1da%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582449fac1704bde2%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe7620169d16db78e9c71%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cdfbf844ca395cec%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r46bebdeb59b8b7212d63a010ca445a9f5c4e9d64dcf693cab6f399d3%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5d8bea8e9d17b6efcf4a0e4e194e91ef46a99f505777a31a60da2b38%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r65ee95fa09c831843bac81eaa582fdddc2b6119912a72d1c83a9b882%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r6fdd4c61a09a0c89f581b4ddb3dc6f154ab0c705fcfd0a7358b2e4e5%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7762d69e85c58d6948823424017ef4c08f47de077644277fa18cc116%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r8170007fd9b263d65b37d92a7b5d7bc357aedbb113a32838bc4a9485%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r94930e39b60fff236160c1c4110fe884dc093044b067aa5fc98d7ee1%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r9e59ebaf76fd00b2fa3ff5ebf18fe075ca9f4376216612c696f76718%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r9ecf211c22760b00967ebe158c6ed7dba9142078e2a630ab8904a5b7%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra275f29615f35d5b40106d1582a41e5388b2a5131564e9e01a572987%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rac5ee5d686818be7e7c430d35108ee01a88aae54f832d32f62431fd1%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb43f9a65150948a6bebd3cb77ee3e105d40db2820fd547528f4e7f89%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb5eedf90ba3633e171a2ffdfe484651c9490dc5df74c8a29244cbc0e%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb73708bf714ed6dbc1212da082e7703e586077f0c92f3940b2e82caf%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rb99c7321eba5d4c907beec46675d52827528b738cfafd48eb4d862f1%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rc717fd6c65190f4e592345713f9ef0723fb7d71f624caa2a17caa26a%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcc72b497e3dff2dc62ec9b89ceb90bc4e1b14fc56c3c252a6fcbb013%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rdea588d4a0ebf9cb7ce8c3a8f18d0d306507c4f8ba178dd3d20207b8%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/rdf311f13e6356297e0ffe74397fdd25a3687b0a16e687c3ff5b834d8%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rdf8d389271a291dde3b2f99c36918d6cb1e796958af626cc140fee23%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re7326b8655eab931f2a9ce074fd9a1a51b5db11456bee9b48e1e170c%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re8ae2670ec456ef1c5a2a661a2838ab2cd00e9efa1e88c069f546f21%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/rf28ab6f224b48452afd567dfffb705fbda0fdbbf6535f6bc69d47e91%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfc1ccfe89332155b72ce17f13a2701d3e7b9ec213324ceb90e79a28a%40%3Cdev.ranger.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html","https://security.netapp.com/advisory/ntap-20200327-0002/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8840","description":"FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u15"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-5436","versionConstraint":"< 7.38.0-4+deb8u15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-5436","fix":{"state":"fixed","versions":["7.38.0-4+deb8u15"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u15"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-10","epss":0.49739,"percentile":0.98872}],"risk":24.8695,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5436"},"relatedVulnerabilities":[{"id":"CVE-2019-5436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-10","epss":0.49739,"percentile":0.98872}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html","http://www.openwall.com/lists/oss-security/2019/09/11/6","https://curl.haxx.se/docs/CVE-2019-5436.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20190606-0004/","https://support.f5.com/csp/article/K55133295","https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5436","description":"A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5436","versionConstraint":"< 7.38.0-4+deb8u15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-5436","fix":{"state":"fixed","versions":["7.38.0-4+deb8u15"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u15"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-10","epss":0.49739,"percentile":0.98872}],"risk":24.8695,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5436"},"relatedVulnerabilities":[{"id":"CVE-2019-5436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-10","epss":0.49739,"percentile":0.98872}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html","http://www.openwall.com/lists/oss-security/2019/09/11/6","https://curl.haxx.se/docs/CVE-2019-5436.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20190606-0004/","https://support.f5.com/csp/article/K55133295","https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5436","description":"A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5436","versionConstraint":"< 7.38.0-4+deb8u15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-5436","fix":{"state":"fixed","versions":["7.38.0-4+deb8u15"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u15"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-10","epss":0.49739,"percentile":0.98872}],"risk":24.8695,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5436"},"relatedVulnerabilities":[{"id":"CVE-2019-5436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-10","epss":0.49739,"percentile":0.98872}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html","http://www.openwall.com/lists/oss-security/2019/09/11/6","https://curl.haxx.se/docs/CVE-2019-5436.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20190606-0004/","https://support.f5.com/csp/article/K55133295","https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5436","description":"A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mph4-vhrx-mv67","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mph4-vhrx-mv67","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2024-03-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12384","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-12384","date":"2026-10-10","epss":0.45205,"percentile":0.98756}],"risk":24.636725000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-12384","https://doyensec.com/research.html","https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad","https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html","https://access.redhat.com/errata/RHSA-2019:1820","https://access.redhat.com/errata/RHSA-2019:2720","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:2998","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2019:3292","https://access.redhat.com/errata/RHSA-2019:3297","https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2019:4352","https://blog.doyensec.com/2019/07/22/jackson-gadgets.html","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe@%3Cnotifications.geode.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://seclists.org/bugtraq/2019/Oct/6","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/issues/2334","https://github.com/FasterXML/jackson-databind/commit/c9ef4a10d6f6633cf470d6a469514b68fa2be234","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC","https://security.netapp.com/advisory/ntap-20190703-0002"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mph4-vhrx-mv67","description":"Deserialization of Untrusted Data in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-12384","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12384","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-12384","date":"2026-10-10","epss":0.45205,"percentile":0.98756}],"urls":["https://access.redhat.com/errata/RHSA-2019:1820","https://access.redhat.com/errata/RHSA-2019:2720","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:2998","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2019:3292","https://access.redhat.com/errata/RHSA-2019:3297","https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2019:4352","https://blog.doyensec.com/2019/07/22/jackson-gadgets.html","https://doyensec.com/research.html","https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe%40%3Cnotifications.geode.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20190703-0002/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12384","description":"FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mph4-vhrx-mv67","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mph4-vhrx-mv67","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2024-03-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12384","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-12384","date":"2026-10-10","epss":0.45205,"percentile":0.98756}],"risk":24.636725000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-12384","https://doyensec.com/research.html","https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad","https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html","https://access.redhat.com/errata/RHSA-2019:1820","https://access.redhat.com/errata/RHSA-2019:2720","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:2998","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2019:3292","https://access.redhat.com/errata/RHSA-2019:3297","https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2019:4352","https://blog.doyensec.com/2019/07/22/jackson-gadgets.html","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe@%3Cnotifications.geode.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://seclists.org/bugtraq/2019/Oct/6","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/issues/2334","https://github.com/FasterXML/jackson-databind/commit/c9ef4a10d6f6633cf470d6a469514b68fa2be234","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC","https://security.netapp.com/advisory/ntap-20190703-0002"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mph4-vhrx-mv67","description":"Deserialization of Untrusted Data in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-12384","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12384","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-12384","date":"2026-10-10","epss":0.45205,"percentile":0.98756}],"urls":["https://access.redhat.com/errata/RHSA-2019:1820","https://access.redhat.com/errata/RHSA-2019:2720","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:2998","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2019:3292","https://access.redhat.com/errata/RHSA-2019:3297","https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2019:4352","https://blog.doyensec.com/2019/07/22/jackson-gadgets.html","https://doyensec.com/research.html","https://github.com/FasterXML/jackson-databind/compare/74b90a4...a977aad","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe%40%3Cnotifications.geode.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20190703-0002/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12384","description":"FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible."}]},{"artifact":{"id":"086860a1c675b6eb","cpes":["cpe:2.3:a:libgnutls-deb0-28:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0-28:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*"],"name":"libgnutls-deb0-28","purl":"pkg:deb/debian/libgnutls-deb0-28@3.3.8-6%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=gnutls28","type":"deb","version":"3.3.8-6+deb8u3","language":"","licenses":["sha256:cffad6d97811bc8c8755b86819dbece70c2da355bf2d50a24bdc0e85a6cc2fef"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-deb0-28/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libgnutls-deb0-28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.3.8-6+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5334","versionConstraint":"< 3.3.8-6+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"gnutls28","version":"3.3.8-6+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-5334","fix":{"state":"fixed","versions":["3.3.8-6+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.3.8-6+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5334","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5334","date":"2026-10-10","epss":0.32754,"percentile":0.98314}],"risk":24.5655,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-5334"},"relatedVulnerabilities":[{"id":"CVE-2017-5334","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5334","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5334","date":"2026-10-10","epss":0.32754,"percentile":0.98314}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html","http://www.openwall.com/lists/oss-security/2017/01/10/7","http://www.openwall.com/lists/oss-security/2017/01/11/4","http://www.securityfocus.com/bid/95370","http://www.securitytracker.com/id/1037576","https://access.redhat.com/errata/RHSA-2017:2292","https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b","https://gnutls.org/security.html#GNUTLS-SA-2017-1","https://security.gentoo.org/glsa/201702-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5334","description":"Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0732","versionConstraint":"< 1.0.1t-1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0732","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-10","epss":0.48831,"percentile":0.98852}],"risk":24.4155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0732"},"relatedVulnerabilities":[{"id":"CVE-2018-0732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-10","epss":0.48831,"percentile":0.98852}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104442","http://www.securitytracker.com/id/1041090","https://access.redhat.com/errata/RHSA-2018:2552","https://access.redhat.com/errata/RHSA-2018:2553","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:1296","https://access.redhat.com/errata/RHSA-2019:1297","https://access.redhat.com/errata/RHSA-2019:1543","https://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-03","https://security.netapp.com/advisory/ntap-20181105-0001/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180612.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0732","description":"During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o)."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0732","versionConstraint":"< 1.0.1t-1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0732","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-10","epss":0.48831,"percentile":0.98852}],"risk":24.4155,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0732"},"relatedVulnerabilities":[{"id":"CVE-2018-0732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-10","epss":0.48831,"percentile":0.98852}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104442","http://www.securitytracker.com/id/1041090","https://access.redhat.com/errata/RHSA-2018:2552","https://access.redhat.com/errata/RHSA-2018:2553","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:1296","https://access.redhat.com/errata/RHSA-2019:1297","https://access.redhat.com/errata/RHSA-2019:1543","https://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-03","https://security.netapp.com/advisory/ntap-20181105-0001/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180612.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0732","description":"During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o)."}]},{"artifact":{"id":"1b0f8262f0bac2cd","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-11235","versionConstraint":"< 1:2.1.4-2.1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11235","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-11235","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11235","date":"2026-10-10","epss":0.48062,"percentile":0.98831}],"risk":24.031,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4212-1","link":"https://security-tracker.debian.org/tracker/DSA-4212-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11235"},"relatedVulnerabilities":[{"id":"CVE-2018-11235","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11235","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11235","date":"2026-10-10","epss":0.48062,"percentile":0.98831}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://www.securityfocus.com/bid/104345","http://www.securitytracker.com/id/1040991","https://access.redhat.com/errata/RHSA-2018:1957","https://access.redhat.com/errata/RHSA-2018:2147","https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/","https://marc.info/?l=git&m=152761328506724&w=2","https://security.gentoo.org/glsa/201805-13","https://usn.ubuntu.com/3671-1/","https://www.debian.org/security/2018/dsa-4212","https://www.exploit-db.com/exploits/44822/","https://github.com/git-for-windows/git/releases/tag/v2.17.1.windows.1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11235","description":"In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs \"git clone --recurse-submodules\" because submodule \"names\" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with \"../\" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server."}]},{"artifact":{"id":"c887d301ab2f172c","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u2?arch=all&distro=debian-8.5&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11235","versionConstraint":"< 1:2.1.4-2.1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-11235","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-11235","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11235","date":"2026-10-10","epss":0.48062,"percentile":0.98831}],"risk":24.031,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4212-1","link":"https://security-tracker.debian.org/tracker/DSA-4212-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-11235"},"relatedVulnerabilities":[{"id":"CVE-2018-11235","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11235","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11235","date":"2026-10-10","epss":0.48062,"percentile":0.98831}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://www.securityfocus.com/bid/104345","http://www.securitytracker.com/id/1040991","https://access.redhat.com/errata/RHSA-2018:1957","https://access.redhat.com/errata/RHSA-2018:2147","https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/","https://marc.info/?l=git&m=152761328506724&w=2","https://security.gentoo.org/glsa/201805-13","https://usn.ubuntu.com/3671-1/","https://www.debian.org/security/2018/dsa-4212","https://www.exploit-db.com/exploits/44822/","https://github.com/git-for-windows/git/releases/tag/v2.17.1.windows.1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11235","description":"In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs \"git clone --recurse-submodules\" because submodule \"names\" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with \"../\" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6303","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6303","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6303","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6303","date":"2026-10-10","epss":0.31985,"percentile":0.98277}],"risk":23.988750000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6303"},"relatedVulnerabilities":[{"id":"CVE-2016-6303","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6303","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6303","date":"2026-10-10","epss":0.31985,"percentile":0.98277}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/92984","http://www.securitytracker.com/id/1036885","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1370146","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=55d83bf7c10c7b205fffa23fa7c3977491e56c07","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6303","description":"Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6303","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6303","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6303","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6303","date":"2026-10-10","epss":0.31985,"percentile":0.98277}],"risk":23.988750000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6303"},"relatedVulnerabilities":[{"id":"CVE-2016-6303","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6303","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6303","date":"2026-10-10","epss":0.31985,"percentile":0.98277}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/92984","http://www.securitytracker.com/id/1036885","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1370146","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=55d83bf7c10c7b205fffa23fa7c3977491e56c07","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6303","description":"Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"7eaafe3de0d9d3c6","cpes":["cpe:2.3:a:wget:wget:1.16-1:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/debian/wget@1.16-1?arch=amd64&distro=debian-8.5","type":"deb","version":"1.16-1","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16-1+deb8u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-4971","versionConstraint":"< 1.16-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"wget","version":"1.16-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4971","fix":{"state":"fixed","versions":["1.16-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.16-1+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-4971","date":"2026-10-10","epss":0.4606,"percentile":0.98782}],"risk":23.03,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4971"},"relatedVulnerabilities":[{"id":"CVE-2016-4971","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-4971","date":"2026-10-10","epss":0.4606,"percentile":0.98782}],"urls":["http://git.savannah.gnu.org/cgit/wget.git/commit/?id=e996e322ffd42aaa051602da182d03178d0f13e1","http://lists.gnu.org/archive/html/info-gnu/2016-06/msg00004.html","http://lists.opensuse.org/opensuse-updates/2016-08/msg00043.html","http://packetstormsecurity.com/files/162395/GNU-wget-Arbitrary-File-Upload-Code-Execution.html","http://rhn.redhat.com/errata/RHSA-2016-2587.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91530","http://www.securitytracker.com/id/1036133","http://www.ubuntu.com/usn/USN-3012-1","https://bugzilla.redhat.com/show_bug.cgi?id=1343666","https://security.gentoo.org/glsa/201610-11","https://security.paloaltonetworks.com/CVE-2016-4971","https://www.exploit-db.com/exploits/40064/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4971","description":"GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource."}]},{"artifact":{"id":"d43082fa89b8e644","cpes":["cpe:2.3:a:apache:mina-core:2.0.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:mina_core:2.0.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.0.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:mina:2.0.9:*:*:*:*:*:*:*"],"name":"mina-core","purl":"pkg:maven/org.apache.mina/mina-core@2.0.9","type":"java-archive","version":"2.0.9","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"org.apache.mina","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:stash-ssh-3.11.4.jar:META-INF/lib/mina-core-2.0.9.jar","manifestName":"","pomArtifactID":"mina-core","archiveDigests":[{"value":"255f546277515f2191105e89f4d768e3ca02db9c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:stash-ssh-3.11.4.jar:META-INF/lib/mina-core-2.0.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.0.27"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-76h9-2vwh-w278","versionConstraint":">=2.0.0-M1,<2.0.27 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.mina:mina-core","version":"2.0.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-76h9-2vwh-w278","fix":{"state":"fixed","versions":["2.0.27"],"available":[{"date":"2024-12-27","kind":"first-observed","version":"2.0.27"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","metrics":{"baseScore":10},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52046","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2024-52046","cwe":"CWE-502","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-52046","date":"2026-10-10","epss":0.24366,"percentile":0.97823}],"risk":23.02587,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-52046","https://lists.apache.org/thread/4wxktgjpggdbto15d515wdctohb0qmv8","http://www.openwall.com/lists/oss-security/2024/12/25/1","https://security.netapp.com/advisory/ntap-20250103-0001"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-76h9-2vwh-w278","description":"Apache MINA Deserialization RCE Vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2024-52046","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":10},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-52046","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2024-52046","cwe":"CWE-502","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-52046","date":"2026-10-10","epss":0.24366,"percentile":0.97823}],"urls":["https://lists.apache.org/thread/4wxktgjpggdbto15d515wdctohb0qmv8","http://www.openwall.com/lists/oss-security/2024/12/25/1","https://security.netapp.com/advisory/ntap-20250103-0001/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-52046","description":"The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process\nincoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows\nattackers to exploit the deserialization process by sending specially crafted malicious serialized data,\npotentially leading to remote code execution (RCE) attacks.\n\n\n\n\t\t\t\t\t\n\n\n\t\t\t\t\n\n\n\t\t\t\n\n\n\t\t\n\n\n\t\nThis issue affects MINA core versions 2.0.X, 2.1.X and 2.2.X, and will be fixed by the releases 2.0.27, 2.1.10 and 2.2.4.\n\n\n\n\n\nIt's also important to note that an application using MINA core library will only be affected if the IoBuffer#getObject() method is called, and this specific method is potentially called when adding a ProtocolCodecFilter instance using the ObjectSerializationCodecFactory class in the filter chain. If your application is specifically using those classes, you have to upgrade to the latest version of MINA core library.\n\n\n\n\nUpgrading will  not be enough: you also need to explicitly allow the classes the decoder will accept in the ObjectSerializationDecoder instance, using one of the three new methods:\n\n\n\n\n    /**\n\n     * Accept class names where the supplied ClassNameMatcher matches for\n\n     * deserialization, unless they are otherwise rejected.\n\n     *\n\n     * @param classNameMatcher the matcher to use\n\n     */\n\n    public void accept(ClassNameMatcher classNameMatcher)\n\n\n\n\n    /**\n\n     * Accept class names that match the supplied pattern for\n\n     * deserialization, unless they are otherwise rejected.\n\n     *\n\n     * @param pattern standard Java regexp\n\n     */\n\n    public void accept(Pattern pattern) \n\n\n\n\n\n    /**\n\n     * Accept the wildcard specified classes for deserialization,\n\n     * unless they are otherwise rejected.\n\n     *\n\n     * @param patterns Wildcard file name patterns as defined by\n\n     *                  {@link org.apache.commons.io.FilenameUtils#wildcardMatch(String, String) FilenameUtils.wildcardMatch}\n\n     */\n\n    public void accept(String... patterns)\n\n\n\n\n\n\n\nBy default, the decoder will reject *all* classes that will be present in the incoming data.\n\n\n\n\n\n\n\nNote: The FtpServer, SSHd and Vysper sub-project are not affected by this issue."}]},{"artifact":{"id":"d4a4e53150a9623c","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.17.2-1.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.17.2-1.1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=nss","type":"deb","version":"2:3.17.2-1.1+deb8u2","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12404","versionConstraint":"< 2:3.26-1+debu8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"nss","version":"2:3.17.2-1.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12404","fix":{"state":"fixed","versions":["2:3.26-1+debu8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u4"}]},"cvss":[],"epss":[{"cve":"CVE-2018-12404","date":"2026-10-10","epss":0.44248,"percentile":0.98729}],"risk":22.124,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12404"},"relatedVulnerabilities":[{"id":"CVE-2018-12404","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-12404","date":"2026-10-10","epss":0.44248,"percentile":0.98729}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html","http://www.securityfocus.com/bid/107260","https://access.redhat.com/errata/RHSA-2019:2237","https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-12404","https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf","https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html","https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12404","description":"A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41."}]},{"artifact":{"id":"002ac568eb8b9e86","cpes":["cpe:2.3:a:apache:commons-beanutils:1.9.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_beanutils:1.9.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:beanutils:1.9.2:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9.2:*:*:*:*:*:*:*"],"name":"commons-beanutils","purl":"pkg:maven/commons-beanutils/commons-beanutils@1.9.2","type":"java-archive","version":"1.9.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-beanutils","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-beanutils-1.9.2.jar","manifestName":"","pomArtifactID":"commons-beanutils","archiveDigests":[{"value":"7a87d845ad3a155297e8f67d9008f4c1e5656b71","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-beanutils-1.9.2.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-beanutils-1.9.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.9.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6phf-73q6-gh87","versionConstraint":"<1.9.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-beanutils:commons-beanutils","version":"1.9.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6phf-73q6-gh87","fix":{"state":"fixed","versions":["1.9.4"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.9.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10086","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10086","date":"2026-10-10","epss":0.28384,"percentile":0.98087}],"risk":21.00416,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-10086","https://access.redhat.com/errata/RHSA-2019:4317","https://access.redhat.com/errata/RHSA-2020:0057","https://access.redhat.com/errata/RHSA-2020:0194","https://access.redhat.com/errata/RHSA-2020:0804","https://access.redhat.com/errata/RHSA-2020:0805","https://access.redhat.com/errata/RHSA-2020:0806","https://access.redhat.com/errata/RHSA-2020:0811","https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48@%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6@%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0@%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa@%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3@%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f@%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9@%3Cdev.brooklyn.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html","http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4@apache.org%3e","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4@%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca@%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db@%3Cdev.rocketmq.apache.org%3E","https://lists.apache.org/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58@%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1@%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6@%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c@%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba@%3Ccommits.atlas.apache.org%3E","https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f@%3Cdev.atlas.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2021.html","https://lists.apache.org/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825@%3Ccommits.dolphinscheduler.apache.org%3E","https://lists.apache.org/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c@%3Ccommits.dolphinscheduler.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/r46e536fc98942dce99fadd2e313aeefe90c1a769c5cd85d98df9d098@%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2@%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534@%3Cissues.nifi.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e@%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe@%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957@%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1@%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997@%3Cissues.nifi.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6phf-73q6-gh87","description":"Insecure Deserialization in Apache Commons Beanutils"},"relatedVulnerabilities":[{"id":"CVE-2019-10086","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10086","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10086","date":"2026-10-10","epss":0.28384,"percentile":0.98087}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00007.html","http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/%3cC628798F-315D-4428-8CB1-4ED1ECC958E4%40apache.org%3e","https://access.redhat.com/errata/RHSA-2019:4317","https://access.redhat.com/errata/RHSA-2020:0057","https://access.redhat.com/errata/RHSA-2020:0194","https://access.redhat.com/errata/RHSA-2020:0804","https://access.redhat.com/errata/RHSA-2020:0805","https://access.redhat.com/errata/RHSA-2020:0806","https://access.redhat.com/errata/RHSA-2020:0811","https://lists.apache.org/thread.html/02094ad226dbc17a2368beaf27e61d8b1432f5baf77d0ca995bb78bc%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/1f78f1e32cc5614ec0c5b822ba4bd7fc8e8b5c46c8e038b6bd609cb5%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/2fd61dc89df9aeab738d2b49f48d42c76f7d53b980ba04e1d48bce48%40%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/3d1ed1a1596c08c4d5fea97b36c651ce167b773f1afc75251ce7a125%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/5261066cd7adee081ee05c8bf0e96cf0b2eeaced391e19117ae4daa6%40%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/956995acee0d8bc046f1df0a55b7fbeb65dd2f82864e5de1078bacb0%40%3Cissues.commons.apache.org%3E","https://lists.apache.org/thread.html/a684107d3a78e431cf0fbb90629e8559a36ff8fe94c3a76e620b39fa%40%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/c94bc9649d5109a663b2129371dc45753fbdeacd340105548bbe93c3%40%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/d6ca9439c53374b597f33b7ec180001625597db48ea30356af01145f%40%3Cdev.shiro.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r18d8b4f9263e5cad3bbaef0cdba0e2ccdf9201316ac4b85e23eb7ee4%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r2d5f1d88c39bd615271abda63964a0bee9b2b57fef1f84cb4c43032e%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/r306c0322aa5c0da731e03f3ce9f07f4745c052c6b73f4e78faf232ca%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r43de02fd4a4f52c4bdeff8c02f09625d83cd047498009c1cdab857db%40%3Cdev.rocketmq.apache.org%3E","https://lists.apache.org/thread.html/r46e536fc98942dce99fadd2e313aeefe90c1a769c5cd85d98df9d098%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/r513a7a21c422170318115463b399dd58ab447fe0990b13e5884f0825%40%3Ccommits.dolphinscheduler.apache.org%3E","https://lists.apache.org/thread.html/r6194ced4828deb32023cd314e31f41c61d388b58935d102c7de91f58%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3E","https://lists.apache.org/thread.html/ra41fd0ad4b7e1d675c03a5081a16a6603085a4e37d30b866067566fe%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/ra87ac17410a62e813cba901fdd4e9a674dd53daaf714870f28e905f1%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/ra9a139fdc0999750dcd519e81384bc1fe3946f311b1796221205f51c%40%3Ccommits.dolphinscheduler.apache.org%3E","https://lists.apache.org/thread.html/racd3e7b2149fa2f255f016bd6bffab0fea77b6fb81c50db9a17f78e6%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/rae81e0c8ebdf47ffaa85a01240836bfece8a990c48f55c7933162b5c%40%3Cdev.atlas.apache.org%3E","https://lists.apache.org/thread.html/rb1f76c2c0a4d6efb8a3523974f9d085d5838b73e7bffdf9a8f212997%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/rb8dac04cb7e9cc5dedee8dabaa1c92614f590642e5ebf02a145915ba%40%3Ccommits.atlas.apache.org%3E","https://lists.apache.org/thread.html/rcc029be4edaaf5b8bb85818aab494e16f312fced07a0f4a202771ba2%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/rd2d2493f4f1af6980d265b8d84c857e2b7ab80a46e1423710c448957%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/re2028d4d76ba1db3e3c3a722d6c6034e801cc3b309f69cc166eaa32b%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/re3cd7cb641d7fc6684e4fc3c336a8bad4a01434bb5625a06e3600fd1%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/rec74f3a94dd850259c730b4ba6f7b6211222b58900ec088754aa0534%40%3Cissues.nifi.apache.org%3E","https://lists.apache.org/thread.html/reee57101464cf7622d640ae013b2162eb864f603ec4093de8240bb8f%40%3Cdev.atlas.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4APPGLBWMFAS4WHNLR4LIJ65DJGPV7TF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIUYSL2RSIWZVNSUIXJTIFPIPIF6OAIO/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10086","description":"In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6306","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6306","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6306","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6306","date":"2026-10-10","epss":0.41683,"percentile":0.98655}],"risk":20.8415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6306"},"relatedVulnerabilities":[{"id":"CVE-2016-6306","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6306","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6306","date":"2026-10-10","epss":0.41683,"percentile":0.98655}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/93153","http://www.securitytracker.com/id/1036885","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.f5.com/csp/article/K90492697","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.openssl.org/news/secadv/20160922.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6306","description":"The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6306","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6306","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6306","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6306","date":"2026-10-10","epss":0.41683,"percentile":0.98655}],"risk":20.8415,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6306"},"relatedVulnerabilities":[{"id":"CVE-2016-6306","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6306","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6306","date":"2026-10-10","epss":0.41683,"percentile":0.98655}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/93153","http://www.securitytracker.com/id/1036885","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.f5.com/csp/article/K90492697","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.openssl.org/news/secadv/20160922.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6306","description":"The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c."}]},{"artifact":{"id":"9dbb6ff7d83fd258","cpes":["cpe:2.3:a:org.springframework:spring-expression:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_expression:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring-expression:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-expression:spring_expression:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring-expression:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_expression:spring_expression:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-expression:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_expression:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-expression:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_expression:4.1.6.RELEASE:*:*:*:*:*:*:*"],"name":"spring-expression","purl":"pkg:maven/org.springframework/spring-expression@4.1.6.RELEASE","type":"java-archive","version":"4.1.6.RELEASE","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-expression-4.1.6.RELEASE.jar","manifestName":"","pomArtifactID":"spring-expression","archiveDigests":[{"value":"8bf70887c2c883a6f6e552dbe46eec35c07adf6a","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-expression-4.1.6.RELEASE.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-expression-4.1.6.RELEASE.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.2.20.RELEASE"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-558x-2xjg-6232","versionConstraint":"<5.2.20.RELEASE (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-expression","version":"4.1.6.RELEASE"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-558x-2xjg-6232","fix":{"state":"fixed","versions":["5.2.20.RELEASE"],"available":[{"date":"2023-03-29","kind":"first-observed","version":"5.2.20.RELEASE"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22950","cwe":"CWE-770","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2022-22950","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22950","date":"2026-10-10","epss":0.36081,"percentile":0.98445}],"risk":20.746575,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22950","https://tanzu.vmware.com/security/cve-2022-22950","https://github.com/spring-projects/spring-framework/issues/28145","https://github.com/spring-projects/spring-framework/issues/28257","https://github.com/spring-projects/spring-framework/commit/83ac65915871067c39a4fb255e0d484c785c0c11","https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE","https://github.com/spring-projects/spring-framework/releases/tag/v5.3.17"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-558x-2xjg-6232","description":"Allocation of Resources Without Limits or Throttling in Spring Framework"},"relatedVulnerabilities":[{"id":"CVE-2022-22950","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22950","cwe":"CWE-770","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2022-22950","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22950","date":"2026-10-10","epss":0.36081,"percentile":0.98445}],"urls":["https://tanzu.vmware.com/security/cve-2022-22950"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22950","description":"n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8610","versionConstraint":"< 1.0.1t-1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8610","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8610","date":"2026-10-10","epss":0.39657,"percentile":0.98588}],"risk":19.8285,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3773-1","link":"https://security-tracker.debian.org/tracker/DSA-3773-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8610"},"relatedVulnerabilities":[{"id":"CVE-2016-8610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8610","date":"2026-10-10","epss":0.39657,"percentile":0.98588}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0286.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://rhn.redhat.com/errata/RHSA-2017-1415.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/oss-sec/2016/q4/224","http://www.securityfocus.com/bid/93841","http://www.securitytracker.com/id/1037084","https://access.redhat.com/errata/RHSA-2017:1413","https://access.redhat.com/errata/RHSA-2017:1414","https://access.redhat.com/errata/RHSA-2017:1658","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401","https://security.360.cn/cve/CVE-2016-8610/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc","https://security.netapp.com/advisory/ntap-20171130-0001/","https://security.paloaltonetworks.com/CVE-2016-8610","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us","https://www.debian.org/security/2017/dsa-3773","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8610","description":"A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-8610","versionConstraint":"< 1.0.1t-1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8610","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8610","date":"2026-10-10","epss":0.39657,"percentile":0.98588}],"risk":19.8285,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3773-1","link":"https://security-tracker.debian.org/tracker/DSA-3773-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8610"},"relatedVulnerabilities":[{"id":"CVE-2016-8610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8610","date":"2026-10-10","epss":0.39657,"percentile":0.98588}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0286.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://rhn.redhat.com/errata/RHSA-2017-1415.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/oss-sec/2016/q4/224","http://www.securityfocus.com/bid/93841","http://www.securitytracker.com/id/1037084","https://access.redhat.com/errata/RHSA-2017:1413","https://access.redhat.com/errata/RHSA-2017:1414","https://access.redhat.com/errata/RHSA-2017:1658","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401","https://security.360.cn/cve/CVE-2016-8610/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc","https://security.netapp.com/advisory/ntap-20171130-0001/","https://security.paloaltonetworks.com/CVE-2016-8610","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us","https://www.debian.org/security/2017/dsa-3773","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8610","description":"A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u221-2.6.18-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-2684","versionConstraint":"< 7u221-2.6.18-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-2684","fix":{"state":"fixed","versions":["7u221-2.6.18-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u221-2.6.18-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2019-2684","date":"2026-10-10","epss":0.37618,"percentile":0.98507}],"risk":18.809,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-2684"},"relatedVulnerabilities":[{"id":"CVE-2019-2684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-2684","date":"2026-10-10","epss":0.37618,"percentile":0.98507}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00007.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html","http://www.openwall.com/lists/oss-security/2020/09/01/4","http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:1146","https://access.redhat.com/errata/RHSA-2019:1163","https://access.redhat.com/errata/RHSA-2019:1164","https://access.redhat.com/errata/RHSA-2019:1165","https://access.redhat.com/errata/RHSA-2019:1166","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:1325","https://access.redhat.com/errata/RHSA-2019:1518","https://lists.apache.org/thread.html/38a01302c92ae513910d8c851a2d111736565bd698be4e3af3e4c063%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/71bd3e4e222479c266eaafc8d0c171ef5782a69b52f68df11b650ed7%40%3Cusers.tomcat.apache.org%3E","https://lists.apache.org/thread.html/c58d6c3b49c615916b163809f963a55421cac2264885739508e68108%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/f7f54b4888060d99f59993f006e25005a2b58db0c07ff866bdcd6f17%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r1fd117082b992e7d43c1286e966c285f98aa362e685695d999ff42f7%40%3Cuser.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r718e01f61b35409a4f7a3ccbc1cb5136a1558a9f9c2cb8d4ca9be1ce%40%3Cuser.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rab8d90d28f944d84e4d7852f355a25c89451ae02c2decc4d355a9cfc%40%3Cuser.cassandra.apache.org%3E","https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cdev.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cuser.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html","https://seclists.org/bugtraq/2019/May/75","https://security.gentoo.org/glsa/201908-10","https://support.f5.com/csp/article/K11175903?utm_source=f5support&amp%3Butm_medium=RSS","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us","https://usn.ubuntu.com/3975-1/","https://www.debian.org/security/2019/dsa-4453"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2684","description":"Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)."}]},{"artifact":{"id":"a514e68f3d5fa38c","cpes":["cpe:2.3:a:springsource-spring-framework:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring-framework:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring-framework:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring-framework:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring_framework:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:vmware:springsource_spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource-spring:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource_spring:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:pivotal_software:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-framework:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_framework:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springsource:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-core:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_core:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_framework:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring-core:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_core:4.1.6.RELEASE:*:*:*:*:*:*:*"],"name":"spring-core","purl":"pkg:maven/org.springframework/spring-core@4.1.6.RELEASE","type":"java-archive","version":"4.1.6.RELEASE","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-core-4.1.6.RELEASE.jar","manifestName":"","pomArtifactID":"spring-core","archiveDigests":[{"value":"e2f486124d5dea2d91a9c2ea7d4456bc343ca2cc","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-core-4.1.6.RELEASE.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-core-4.1.6.RELEASE.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.3.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g8hw-794c-4j9g","versionConstraint":"<4.3.15 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-core","version":"4.1.6.RELEASE"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-g8hw-794c-4j9g","fix":{"state":"fixed","versions":["4.3.15"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.3.15"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1271","cwe":"CWE-22","type":"Secondary","source":"security_alert@emc.com"},{"cve":"CVE-2018-1271","cwe":"CWE-22","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1271","date":"2026-10-10","epss":0.34444,"percentile":0.98383}],"risk":18.771980000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-1271","https://access.redhat.com/errata/RHSA-2018:1320","https://access.redhat.com/errata/RHSA-2018:2669","https://access.redhat.com/errata/RHSA-2018:2939","https://pivotal.io/security/cve-2018-1271","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103699","https://www.oracle.com/security-alerts/cpuoct2021.html","https://github.com/spring-projects/spring-framework/commit/0e28bee0f155b9bf240b4bafc4646e4810cb23f8","https://github.com/spring-projects/spring-framework/commit/13356a7ee2240f740737c5c83bdccdacc30603ab","https://github.com/spring-projects/spring-framework/commit/695bf2961feffd35b5560ccc982a2189dcca611f","https://github.com/spring-projects/spring-framework/commit/91b803a2310344d925e5d4b1709bbcea90375548","https://github.com/spring-projects/spring-framework/commit/98ad23bef8e2e04143f8f5b201380543a8d8c0c3","https://github.com/spring-projects/spring-framework/commit/b9ebdaaf3710db473a2e1fec8641c316483a22aa","https://github.com/spring-projects/spring-framework/commit/f046a066eceefa0799d1bc89bd6e1318f39bdf69","https://github.com/spring-projects/spring-framework/commit/f59ea610dfcf55cd0b42f6dd76a9b3dab0218aaa"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g8hw-794c-4j9g","description":"Path Traversal in org.springframework:spring-core"},"relatedVulnerabilities":[{"id":"CVE-2018-1271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1271","cwe":"CWE-22","type":"Secondary","source":"security_alert@emc.com"},{"cve":"CVE-2018-1271","cwe":"CWE-22","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1271","date":"2026-10-10","epss":0.34444,"percentile":0.98383}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103699","https://access.redhat.com/errata/RHSA-2018:1320","https://access.redhat.com/errata/RHSA-2018:2669","https://access.redhat.com/errata/RHSA-2018:2939","https://pivotal.io/security/cve-2018-1271","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1271","description":"Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cggj-fvv3-cqwv","versionConstraint":"<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cggj-fvv3-cqwv","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2024-03-02","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7489","cwe":"CWE-184","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-7489","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7489","date":"2026-10-10","epss":0.19781,"percentile":0.97353}],"risk":18.594140000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-7489","https://github.com/FasterXML/jackson-databind/issues/1931","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:1786","https://access.redhat.com/errata/RHSA-2018:2088","https://access.redhat.com/errata/RHSA-2018:2089","https://access.redhat.com/errata/RHSA-2018:2090","https://access.redhat.com/errata/RHSA-2018:2938","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3E","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2018/dsa-4190","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","https://github.com/FasterXML/jackson-databind/commit/6799f8f10cc78e9af6d443ed6982d00a13f2e7d2","https://github.com/FasterXML/jackson-databind/commit/c921f0935d5e41bf206e702d8077a275ba1a6efc","https://github.com/FasterXML/jackson-databind/commit/ca2bfc86af82a1479112004b663ba74c760752e6","https://github.com/FasterXML/jackson-databind/commit/e66c0a9d3c926ff1b63bf586c824ead1d02f2a3d","https://security.netapp.com/advisory/ntap-20180328-0001","https://github.com/FasterXML/jackson-databind/commit/bc22f90eb7f896ace9567598a99cb1ff6e0f9d9d"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cggj-fvv3-cqwv","description":"FasterXML jackson-databind allows unauthenticated remote code execution"},"relatedVulnerabilities":[{"id":"CVE-2018-7489","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7489","cwe":"CWE-184","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-7489","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7489","date":"2026-10-10","epss":0.19781,"percentile":0.97353}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103203","http://www.securitytracker.com/id/1040693","http://www.securitytracker.com/id/1041890","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:1786","https://access.redhat.com/errata/RHSA-2018:2088","https://access.redhat.com/errata/RHSA-2018:2089","https://access.redhat.com/errata/RHSA-2018:2090","https://access.redhat.com/errata/RHSA-2018:2938","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://github.com/FasterXML/jackson-databind/issues/1931","https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E","https://security.netapp.com/advisory/ntap-20180328-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2018/dsa-4190","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-7489","description":"FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cggj-fvv3-cqwv","versionConstraint":"<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cggj-fvv3-cqwv","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2024-03-02","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7489","cwe":"CWE-184","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-7489","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7489","date":"2026-10-10","epss":0.19781,"percentile":0.97353}],"risk":18.594140000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-7489","https://github.com/FasterXML/jackson-databind/issues/1931","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:1786","https://access.redhat.com/errata/RHSA-2018:2088","https://access.redhat.com/errata/RHSA-2018:2089","https://access.redhat.com/errata/RHSA-2018:2090","https://access.redhat.com/errata/RHSA-2018:2938","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3E","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2018/dsa-4190","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","https://github.com/FasterXML/jackson-databind/commit/6799f8f10cc78e9af6d443ed6982d00a13f2e7d2","https://github.com/FasterXML/jackson-databind/commit/c921f0935d5e41bf206e702d8077a275ba1a6efc","https://github.com/FasterXML/jackson-databind/commit/ca2bfc86af82a1479112004b663ba74c760752e6","https://github.com/FasterXML/jackson-databind/commit/e66c0a9d3c926ff1b63bf586c824ead1d02f2a3d","https://security.netapp.com/advisory/ntap-20180328-0001","https://github.com/FasterXML/jackson-databind/commit/bc22f90eb7f896ace9567598a99cb1ff6e0f9d9d"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cggj-fvv3-cqwv","description":"FasterXML jackson-databind allows unauthenticated remote code execution"},"relatedVulnerabilities":[{"id":"CVE-2018-7489","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7489","cwe":"CWE-184","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-7489","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7489","date":"2026-10-10","epss":0.19781,"percentile":0.97353}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103203","http://www.securitytracker.com/id/1040693","http://www.securitytracker.com/id/1041890","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:1786","https://access.redhat.com/errata/RHSA-2018:2088","https://access.redhat.com/errata/RHSA-2018:2089","https://access.redhat.com/errata/RHSA-2018:2090","https://access.redhat.com/errata/RHSA-2018:2938","https://access.redhat.com/errata/RHSA-2018:2939","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://github.com/FasterXML/jackson-databind/issues/1931","https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E","https://security.netapp.com/advisory/ntap-20180328-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2018/dsa-4190","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-7489","description":"FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath."}]},{"artifact":{"id":"1b0f8262f0bac2cd","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1352","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1352","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-10-10","epss":0.24014,"percentile":0.97796}],"risk":18.0105,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1352"},"relatedVulnerabilities":[{"id":"CVE-2019-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-10-10","epss":0.24014,"percentile":0.97796}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1352","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"c887d301ab2f172c","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u2?arch=all&distro=debian-8.5&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1352","versionConstraint":"< 1:2.1.4-2.1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1352","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-10-10","epss":0.24014,"percentile":0.97796}],"risk":18.0105,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1352"},"relatedVulnerabilities":[{"id":"CVE-2019-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1352","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1352","date":"2026-10-10","epss":0.24014,"percentile":0.97796}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","https://access.redhat.com/errata/RHSA-2020:0228","https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352","https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/","https://security.gentoo.org/glsa/202003-30"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1352","description":"A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p43x-xfjf-5jhr","versionConstraint":">=2.0.0,<2.7.9.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p43x-xfjf-5jhr","fix":{"state":"fixed","versions":["2.7.9.7"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.7.9.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9548","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-9548","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-9548","date":"2026-10-10","epss":0.18921,"percentile":0.97237}],"risk":17.78574,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-9548","https://github.com/FasterXML/jackson-databind/issues/2634","https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6@%3Cissues.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097@%3Cissues.zookeeper.apache.org%3E","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://github.com/FasterXML/jackson-databind/commit/9f4e97019fb0dd836533d0b6198c88787e235ae2","https://github.com/FasterXML/jackson-databind/commit/1e64db6a2fad331f96c7363fda3bc5f3dffa25bb","https://security.netapp.com/advisory/ntap-20200904-0006"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p43x-xfjf-5jhr","description":"jackson-databind mishandles the interaction between serialization gadgets and typing"},"relatedVulnerabilities":[{"id":"CVE-2020-9548","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9548","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-9548","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-9548","date":"2026-10-10","epss":0.18921,"percentile":0.97237}],"urls":["https://github.com/FasterXML/jackson-databind/issues/2634","https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20200904-0006/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-9548","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core)."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-p43x-xfjf-5jhr","versionConstraint":">=2.0.0,<2.7.9.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-p43x-xfjf-5jhr","fix":{"state":"fixed","versions":["2.7.9.7"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.7.9.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9548","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-9548","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-9548","date":"2026-10-10","epss":0.18921,"percentile":0.97237}],"risk":17.78574,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-9548","https://github.com/FasterXML/jackson-databind/issues/2634","https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6@%3Cissues.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097@%3Cissues.zookeeper.apache.org%3E","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://github.com/FasterXML/jackson-databind/commit/9f4e97019fb0dd836533d0b6198c88787e235ae2","https://github.com/FasterXML/jackson-databind/commit/1e64db6a2fad331f96c7363fda3bc5f3dffa25bb","https://security.netapp.com/advisory/ntap-20200904-0006"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p43x-xfjf-5jhr","description":"jackson-databind mishandles the interaction between serialization gadgets and typing"},"relatedVulnerabilities":[{"id":"CVE-2020-9548","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9548","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-9548","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-9548","date":"2026-10-10","epss":0.18921,"percentile":0.97237}],"urls":["https://github.com/FasterXML/jackson-databind/issues/2634","https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20200904-0006/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-9548","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core)."}]},{"artifact":{"id":"313fa3578fbafcd9","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u2:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"2.9.1+dfsg1-5+deb8u2","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7376","versionConstraint":"< 2.9.1+dfsg1-5+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7376","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-7376","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7376","date":"2026-10-10","epss":0.23286,"percentile":0.97733}],"risk":17.4645,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3952-1","link":"https://security-tracker.debian.org/tracker/DSA-3952-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7376"},"relatedVulnerabilities":[{"id":"CVE-2017-7376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7376","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7376","date":"2026-10-10","epss":0.23286,"percentile":0.97733}],"urls":["http://www.securityfocus.com/bid/98877","http://www.securitytracker.com/id/1038623","https://android.googlesource.com/platform/external/libxml2/+/51e0cb2e5ec18eaf6fb331bc573ff27b743898f4","https://bugzilla.redhat.com/show_bug.cgi?id=1462216","https://git.gnome.org/browse/libxml2/commit/?id=5dca9eea1bd4263bfa4d037ab2443de1cd730f7e","https://source.android.com/security/bulletin/2017-06-01","https://www.debian.org/security/2017/dsa-3952"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7376","description":"Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q93h-jc49-78gg","versionConstraint":">=2.0.0,<2.7.9.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q93h-jc49-78gg","fix":{"state":"fixed","versions":["2.7.9.7"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.7.9.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9547","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-9547","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-9547","date":"2026-10-10","epss":0.18383,"percentile":0.9717}],"risk":17.28002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-9547","https://github.com/FasterXML/jackson-databind/issues/2634","https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428@%3Cnotifications.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097@%3Cissues.zookeeper.apache.org%3E","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://security.netapp.com/advisory/ntap-20200904-0006/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://github.com/FasterXML/jackson-databind/commit/9f4e97019fb0dd836533d0b6198c88787e235ae2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q93h-jc49-78gg","description":"jackson-databind mishandles the interaction between serialization gadgets and typing"},"relatedVulnerabilities":[{"id":"CVE-2020-9547","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9547","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-9547","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-9547","date":"2026-10-10","epss":0.18383,"percentile":0.9717}],"urls":["https://github.com/FasterXML/jackson-databind/issues/2634","https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20200904-0006/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-9547","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap)."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-q93h-jc49-78gg","versionConstraint":">=2.0.0,<2.7.9.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-q93h-jc49-78gg","fix":{"state":"fixed","versions":["2.7.9.7"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.7.9.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9547","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-9547","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-9547","date":"2026-10-10","epss":0.18383,"percentile":0.9717}],"risk":17.28002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-9547","https://github.com/FasterXML/jackson-databind/issues/2634","https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428@%3Cnotifications.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097@%3Cissues.zookeeper.apache.org%3E","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://security.netapp.com/advisory/ntap-20200904-0006/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://github.com/FasterXML/jackson-databind/commit/9f4e97019fb0dd836533d0b6198c88787e235ae2"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-q93h-jc49-78gg","description":"jackson-databind mishandles the interaction between serialization gadgets and typing"},"relatedVulnerabilities":[{"id":"CVE-2020-9547","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-9547","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-9547","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-9547","date":"2026-10-10","epss":0.18383,"percentile":0.9717}],"urls":["https://github.com/FasterXML/jackson-databind/issues/2634","https://lists.apache.org/thread.html/r35d30db00440ef63b791c4b7f7acb036e14d4a23afa2a249cb66c0fd%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r4accb2e0de9679174efd3d113a059bab71ff3ec53e882790d21c1cc1%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r742ef70d126548dcf7de5be5779355c9d76a9aec71d7a9ef02c6398a%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r893a0104e50c1c2559eb9a5812add28ae8c3e5f43712947a9847ec18%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r9464a40d25c3ba1a55622db72f113eb494a889656962d098c70c5bb1%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r98c9b6e4c9e17792e2cd1ec3e4aa20b61a791939046d3f10888176bb%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra3e90712f2d59f8cef03fa796f5adf163d32b81fe7b95385f21790e6%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb6fecb5e96a6d61e175ff49f33f2713798dd05cf03067c169d195596%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc0d5d0f72da1ed6fc5e438b1ddb3fa090c73006b55f873cf845375ab%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd0e958d6d5c5ee16efed73314cd0e445c8dbb4bdcc80fc9d1d6c11fc%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd5a4457be4623038c3989294429bc063eec433a2e55995d81591e2ca%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd49ab9565bec436a896bc00c4b9fc9dce1598e106c318524fbdfec6%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rdd4df698d5d8e635144d2994922bf0842e933809eae259521f3b5097%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/redbe4f1e21bf080f637cf9fbec47729750a2f443a919765360337428%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/03/msg00008.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20200904-0006/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-9547","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap)."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5ww9-j83m-q7qx","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5ww9-j83m-q7qx","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2024-03-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12086","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-12086","date":"2026-10-10","epss":0.21949,"percentile":0.97607}],"risk":16.46175,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-12086","https://github.com/FasterXML/jackson-databind/issues/2326","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:2998","https://access.redhat.com/errata/RHSA-2019:3044","https://access.redhat.com/errata/RHSA-2019:3045","https://access.redhat.com/errata/RHSA-2019:3046","https://access.redhat.com/errata/RHSA-2019:3050","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/05/msg00030.html","https://seclists.org/bugtraq/2019/May/68","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679@%3Ccommits.nifi.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://web.archive.org/web/20200227030031/http://www.securityfocus.com/bid/109227","https://github.com/FasterXML/jackson-databind/commit/efc3c0d02f4743dbaa6d1b9c466772a2f13d966b","https://github.com/FasterXML/jackson-databind/commit/dda513bd7251b4f32b7b60b1c13740e3b5a43024","https://github.com/FasterXML/jackson-databind/commit/d30f036208ab1c60bd5ce429cb4f7f1a3e5682e8","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC","https://security.netapp.com/advisory/ntap-20190530-0003","https://web.archive.org/web/20200808181049/http://russiansecurity.expert/2016/04/20/mysql-connect-file-read"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5ww9-j83m-q7qx","description":"Information exposure in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-12086","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12086","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-12086","date":"2026-10-10","epss":0.21949,"percentile":0.97607}],"urls":["http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/","http://www.securityfocus.com/bid/109227","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:2998","https://access.redhat.com/errata/RHSA-2019:3044","https://access.redhat.com/errata/RHSA-2019:3045","https://access.redhat.com/errata/RHSA-2019:3046","https://access.redhat.com/errata/RHSA-2019:3050","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://github.com/FasterXML/jackson-databind/issues/2326","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/05/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12086","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5ww9-j83m-q7qx","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5ww9-j83m-q7qx","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2024-03-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12086","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-12086","date":"2026-10-10","epss":0.21949,"percentile":0.97607}],"risk":16.46175,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-12086","https://github.com/FasterXML/jackson-databind/issues/2326","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:2998","https://access.redhat.com/errata/RHSA-2019:3044","https://access.redhat.com/errata/RHSA-2019:3045","https://access.redhat.com/errata/RHSA-2019:3046","https://access.redhat.com/errata/RHSA-2019:3050","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2@%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/05/msg00030.html","https://seclists.org/bugtraq/2019/May/68","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679@%3Ccommits.nifi.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://web.archive.org/web/20200227030031/http://www.securityfocus.com/bid/109227","https://github.com/FasterXML/jackson-databind/commit/efc3c0d02f4743dbaa6d1b9c466772a2f13d966b","https://github.com/FasterXML/jackson-databind/commit/dda513bd7251b4f32b7b60b1c13740e3b5a43024","https://github.com/FasterXML/jackson-databind/commit/d30f036208ab1c60bd5ce429cb4f7f1a3e5682e8","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC","https://security.netapp.com/advisory/ntap-20190530-0003","https://web.archive.org/web/20200808181049/http://russiansecurity.expert/2016/04/20/mysql-connect-file-read"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5ww9-j83m-q7qx","description":"Information exposure in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-12086","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12086","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-12086","date":"2026-10-10","epss":0.21949,"percentile":0.97607}],"urls":["http://russiansecurity.expert/2016/04/20/mysql-connect-file-read/","http://www.securityfocus.com/bid/109227","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:2998","https://access.redhat.com/errata/RHSA-2019:3044","https://access.redhat.com/errata/RHSA-2019:3045","https://access.redhat.com/errata/RHSA-2019:3046","https://access.redhat.com/errata/RHSA-2019:3050","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://github.com/FasterXML/jackson-databind/issues/2326","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.9","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/88cd25375805950ae7337e669b0cb0eeda98b9604c1b8d806dccbad2%40%3Creviews.spark.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/05/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12086","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u121-2.6.8-2~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3241","versionConstraint":"< 7u121-2.6.8-2~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-3241","fix":{"state":"fixed","versions":["7u121-2.6.8-2~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u121-2.6.8-2~deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3241","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3241","date":"2026-10-10","epss":0.32839,"percentile":0.9832}],"risk":16.4195,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3782-1","link":"https://security-tracker.debian.org/tracker/DSA-3782-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-3241"},"relatedVulnerabilities":[{"id":"CVE-2017-3241","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3241","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3241","date":"2026-10-10","epss":0.32839,"percentile":0.9832}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0175.html","http://rhn.redhat.com/errata/RHSA-2017-0176.html","http://rhn.redhat.com/errata/RHSA-2017-0177.html","http://rhn.redhat.com/errata/RHSA-2017-0180.html","http://rhn.redhat.com/errata/RHSA-2017-0263.html","http://rhn.redhat.com/errata/RHSA-2017-0269.html","http://rhn.redhat.com/errata/RHSA-2017-0336.html","http://rhn.redhat.com/errata/RHSA-2017-0337.html","http://rhn.redhat.com/errata/RHSA-2017-0338.html","http://www.debian.org/security/2017/dsa-3782","http://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.html","http://www.securityfocus.com/bid/95488","http://www.securitytracker.com/id/1037637","https://access.redhat.com/errata/RHSA-2017:1216","https://erpscan.io/advisories/erpscan-17-006-oracle-openjdk-java-serialization-dos-vulnerability/","https://security.gentoo.org/glsa/201701-65","https://security.gentoo.org/glsa/201707-01","https://security.netapp.com/advisory/ntap-20170119-0001/","https://www.exploit-db.com/exploits/41145/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3241","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts)."}]},{"artifact":{"id":"d3d61030b904371f","cpes":["cpe:2.3:a:org.quartz-scheduler.quartz:quartz:2.2.1:*:*:*:*:*:*:*","cpe:2.3:a:org.quartz-scheduler:quartz:2.2.1:*:*:*:*:*:*:*","cpe:2.3:a:quartz-scheduler:quartz:2.2.1:*:*:*:*:*:*:*","cpe:2.3:a:quartz_scheduler:quartz:2.2.1:*:*:*:*:*:*:*","cpe:2.3:a:quartz:quartz:2.2.1:*:*:*:*:*:*:*"],"name":"quartz","purl":"pkg:maven/org.quartz-scheduler/quartz@2.2.1","type":"java-archive","version":"2.2.1","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.quartz-scheduler","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/quartz-2.2.1.jar","manifestName":"","pomArtifactID":"quartz","archiveDigests":[{"value":"2bd17ec0c66d0370a932e225f52c23f3dc7cc4ce","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/quartz-2.2.1.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/quartz-2.2.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.3.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9qcf-c26r-x5rf","versionConstraint":"<2.3.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.quartz-scheduler:quartz","version":"2.2.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9qcf-c26r-x5rf","fix":{"state":"fixed","versions":["2.3.2"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"2.3.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13990","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13990","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13990","date":"2026-10-10","epss":0.162,"percentile":0.96871}],"risk":15.228000000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-13990","https://github.com/quartz-scheduler/quartz/issues/467","https://github.com/quartz-scheduler/quartz/pull/501","https://github.com/quartz-scheduler/quartz/commit/13c1d45aa1db15d0fa0e4997139c99ba219be551","https://snyk.io/vuln/SNYK-JAVA-ORGQUARTZSCHEDULER-461170","https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e870bb82@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d9d22a22cc681e0ec3@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de4b019a1e975502d949@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e83f0d286b90e58e0629@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a3900e16e73275674cdfaf@%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r21df13c8bd2c2eae4b9661aae814c4a2a814d1f7875c765b8b115c9a@%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r3a6884e8d819f32cde8c07b98934de3e80467859880f784950bf44cf@%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/re9b56ac1934d7bf16afc83eac1c39c98c1b20b4b15891dce923bf8aa@%3Ccommits.tomee.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://confluence.atlassian.com/security/ssot-117-cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server-1295385959.html","https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e870bb82%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d9d22a22cc681e0ec3%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de4b019a1e975502d949%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e83f0d286b90e58e0629%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a3900e16e73275674cdfaf%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r21df13c8bd2c2eae4b9661aae814c4a2a814d1f7875c765b8b115c9a%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r3a6884e8d819f32cde8c07b98934de3e80467859880f784950bf44cf%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/re9b56ac1934d7bf16afc83eac1c39c98c1b20b4b15891dce923bf8aa%40%3Ccommits.tomee.apache.org%3E","https://security.netapp.com/advisory/ntap-20221028-0002"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9qcf-c26r-x5rf","description":"XML external entity injection in Terracotta Quartz Scheduler"},"relatedVulnerabilities":[{"id":"CVE-2019-13990","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13990","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13990","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-13990","date":"2026-10-10","epss":0.162,"percentile":0.96871}],"urls":["https://confluence.atlassian.com/security/ssot-117-cve-2019-13990-xxe-xml-external-entity-injection-vulnerability-in-jira-service-management-data-center-and-jira-service-management-server-1295385959.html","https://github.com/quartz-scheduler/quartz/issues/467","https://lists.apache.org/thread.html/172d405e556e2f1204be126bb3eb28c5115af91bcc1651b4e870bb82%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/1870324fea41ea68cff2fd1bf6ee2747432dc1d9d22a22cc681e0ec3%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/6b6e3480b19856365fb5eef03aa0915a4679de4b019a1e975502d949%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/e493e718a50f21201e05e82d42a8796b4046e83f0d286b90e58e0629%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f74b170d3d58d7a24db1afd3908bb0ab58a3900e16e73275674cdfaf%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r21df13c8bd2c2eae4b9661aae814c4a2a814d1f7875c765b8b115c9a%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/r3a6884e8d819f32cde8c07b98934de3e80467859880f784950bf44cf%40%3Ccommits.tomee.apache.org%3E","https://lists.apache.org/thread.html/re9b56ac1934d7bf16afc83eac1c39c98c1b20b4b15891dce923bf8aa%40%3Ccommits.tomee.apache.org%3E","https://security.netapp.com/advisory/ntap-20221028-0002/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13990","description":"initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description."}]},{"artifact":{"id":"2a5c373747b503ef","cpes":["cpe:2.3:a:unzip:unzip:6.0-16\\+deb8u2:*:*:*:*:*:*:*"],"name":"unzip","purl":"pkg:deb/debian/unzip@6.0-16%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"6.0-16+deb8u2","language":"","licenses":["sha256:e4864130ae7765aa9424f558ca7ca8fa01c1674344ab83e4ceec749ccda76980"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/unzip/copyright","layerID":"sha256:b5412699bc1b3b3aaa14a0922fe16091b03148b75d0a0862543f0720beb92e2c","accessPath":"/usr/share/doc/unzip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/unzip.md5sums","layerID":"sha256:b5412699bc1b3b3aaa14a0922fe16091b03148b75d0a0862543f0720beb92e2c","accessPath":"/var/lib/dpkg/info/unzip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/unzip.list","layerID":"sha256:b5412699bc1b3b3aaa14a0922fe16091b03148b75d0a0862543f0720beb92e2c","accessPath":"/var/lib/dpkg/info/unzip.list"},{"path":"/var/lib/dpkg/info/unzip.postinst","layerID":"sha256:b5412699bc1b3b3aaa14a0922fe16091b03148b75d0a0862543f0720beb92e2c","accessPath":"/var/lib/dpkg/info/unzip.postinst"},{"path":"/var/lib/dpkg/info/unzip.postrm","layerID":"sha256:b5412699bc1b3b3aaa14a0922fe16091b03148b75d0a0862543f0720beb92e2c","accessPath":"/var/lib/dpkg/info/unzip.postrm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"6.0-16+deb8u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000035","versionConstraint":"< 6.0-16+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"unzip","version":"6.0-16+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000035","fix":{"state":"fixed","versions":["6.0-16+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"6.0-16+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000035","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000035","date":"2026-10-10","epss":0.30066,"percentile":0.98178}],"risk":15.033,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000035"},"relatedVulnerabilities":[{"id":"CVE-2018-1000035","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000035","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000035","date":"2026-10-10","epss":0.30066,"percentile":0.98178}],"urls":["https://lists.debian.org/debian-lts-announce/2020/01/msg00026.html","https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-infozip-unzip/index.html","https://security.gentoo.org/glsa/202003-58"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000035","description":"A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2180","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2180","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2180","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2180","date":"2026-10-10","epss":0.29982,"percentile":0.98175}],"risk":14.991,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2180"},"relatedVulnerabilities":[{"id":"CVE-2016-2180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2180","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2180","date":"2026-10-10","epss":0.29982,"percentile":0.98175}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92117","http://www.securitytracker.com/id/1036486","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1359615","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/0ed26acce328ec16a3aa635f1ca37365e8c7403a","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2180","description":"The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the \"openssl ts\" command."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2180","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2180","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2180","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2180","date":"2026-10-10","epss":0.29982,"percentile":0.98175}],"risk":14.991,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2180"},"relatedVulnerabilities":[{"id":"CVE-2016-2180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2180","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2180","date":"2026-10-10","epss":0.29982,"percentile":0.98175}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92117","http://www.securitytracker.com/id/1036486","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1359615","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/0ed26acce328ec16a3aa635f1ca37365e8c7403a","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2180","description":"The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the \"openssl ts\" command."}]},{"artifact":{"id":"bc2eeb61a61c87c0","cpes":["cpe:2.3:a:apache:commons-collections:3.2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_collections:3.2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:collections:3.2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:3.2.1:*:*:*:*:*:*:*"],"name":"commons-collections","purl":"pkg:maven/commons-collections/commons-collections@3.2.1","type":"java-archive","version":"3.2.1","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-collections","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-collections-3.2.1.jar","manifestName":"","pomArtifactID":"commons-collections","archiveDigests":[{"value":"761ea405b9b37ced573d2df0d1e3a4e0f9edc668","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-collections-3.2.1.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-collections-3.2.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.2.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6hgm-866r-3cjv","versionConstraint":"<3.2.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-collections:commons-collections","version":"3.2.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6hgm-866r-3cjv","fix":{"state":"fixed","versions":["3.2.2"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"3.2.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-6420","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-6420","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-6420","date":"2026-10-10","epss":0.18763,"percentile":0.97217}],"risk":14.07225,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-6420","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","https://www.kb.cert.org/vuls/id/581311","https://www.tenable.com/security/research/tra-2017-14","https://www.tenable.com/security/research/tra-2017-23","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/78872","https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21@%3Ccommits.samza.apache.org%3E","https://arxiv.org/pdf/2306.05534"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6hgm-866r-3cjv","description":"Insecure Deserialization in Apache Commons Collection"},"relatedVulnerabilities":[{"id":"CVE-2015-6420","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-6420","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2015-6420","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2015-6420","date":"2026-10-10","epss":0.18763,"percentile":0.97217}],"urls":["http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151209-java-deserialization","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/78872","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E","https://www.kb.cert.org/vuls/id/581311","https://www.tenable.com/security/research/tra-2017-14","https://www.tenable.com/security/research/tra-2017-23","https://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/","https://news.apache.org/foundation/entry/apache_commons_statement_to_widespread","https://www.kb.cert.org/vuls/id/576313"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-6420","description":"Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6302","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6302","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6302","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6302","date":"2026-10-10","epss":0.27806,"percentile":0.98054}],"risk":13.902999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6302"},"relatedVulnerabilities":[{"id":"CVE-2016-6302","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6302","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6302","date":"2026-10-10","epss":0.27806,"percentile":0.98054}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92628","http://www.securitytracker.com/id/1036885","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=e97763c92c655dcf4af2860b3abd2bc4c8a267f9","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6302","description":"The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6302","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6302","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6302","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6302","date":"2026-10-10","epss":0.27806,"percentile":0.98054}],"risk":13.902999999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6302"},"relatedVulnerabilities":[{"id":"CVE-2016-6302","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6302","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6302","date":"2026-10-10","epss":0.27806,"percentile":0.98054}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92628","http://www.securitytracker.com/id/1036885","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=e97763c92c655dcf4af2860b3abd2bc4c8a267f9","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6302","description":"The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u16"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-5482","versionConstraint":"< 7.38.0-4+deb8u16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-5482","fix":{"state":"fixed","versions":["7.38.0-4+deb8u16"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u16"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-10","epss":0.17939,"percentile":0.9712}],"risk":13.454250000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5482"},"relatedVulnerabilities":[{"id":"CVE-2019-5482","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-10","epss":0.17939,"percentile":0.9712}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5482.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://security.netapp.com/advisory/ntap-20200416-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5482","versionConstraint":"< 7.38.0-4+deb8u16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-5482","fix":{"state":"fixed","versions":["7.38.0-4+deb8u16"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u16"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-10","epss":0.17939,"percentile":0.9712}],"risk":13.454250000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5482"},"relatedVulnerabilities":[{"id":"CVE-2019-5482","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-10","epss":0.17939,"percentile":0.9712}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5482.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://security.netapp.com/advisory/ntap-20200416-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5482","versionConstraint":"< 7.38.0-4+deb8u16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-5482","fix":{"state":"fixed","versions":["7.38.0-4+deb8u16"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u16"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-10","epss":0.17939,"percentile":0.9712}],"risk":13.454250000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5482"},"relatedVulnerabilities":[{"id":"CVE-2019-5482","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-10","epss":0.17939,"percentile":0.9712}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5482.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://security.netapp.com/advisory/ntap-20200416-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9gph-22xh-8x98","versionConstraint":">=2.0.0,<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9gph-22xh-8x98","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36179","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36179","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36179","date":"2026-10-10","epss":0.17065,"percentile":0.97013}],"risk":13.3107,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36179","https://github.com/FasterXML/jackson-databind/issues/3004","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.apache.org/thread.html/rc255f41d9a61d3dc79a51fb5c713de4ae10e71e3673feeb0b180b436@%3Cissues.spark.apache.org%3E","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/3ded28aece694d0df39c9f0fa1ff385b14a8656b"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9gph-22xh-8x98","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36179","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36179","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36179","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36179","date":"2026-10-10","epss":0.17065,"percentile":0.97013}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/3004","https://lists.apache.org/thread.html/rc255f41d9a61d3dc79a51fb5c713de4ae10e71e3673feeb0b180b436%40%3Cissues.spark.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36179","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9gph-22xh-8x98","versionConstraint":">=2.0.0,<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9gph-22xh-8x98","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36179","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36179","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36179","date":"2026-10-10","epss":0.17065,"percentile":0.97013}],"risk":13.3107,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36179","https://github.com/FasterXML/jackson-databind/issues/3004","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.apache.org/thread.html/rc255f41d9a61d3dc79a51fb5c713de4ae10e71e3673feeb0b180b436@%3Cissues.spark.apache.org%3E","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/3ded28aece694d0df39c9f0fa1ff385b14a8656b"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9gph-22xh-8x98","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36179","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36179","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36179","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36179","date":"2026-10-10","epss":0.17065,"percentile":0.97013}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/3004","https://lists.apache.org/thread.html/rc255f41d9a61d3dc79a51fb5c713de4ae10e71e3673feeb0b180b436%40%3Cissues.spark.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36179","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2179","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2179","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2179","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2179","date":"2026-10-10","epss":0.26559,"percentile":0.97975}],"risk":13.279499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2179"},"relatedVulnerabilities":[{"id":"CVE-2016-2179","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2179","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2179","date":"2026-10-10","epss":0.26559,"percentile":0.97975}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92987","http://www.securitytracker.com/id/1036689","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5c7f5dfbaf0d2f7d946d0fe86f08e6bcb36ed0d","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2179","description":"The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2179","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2179","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2179","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2179","date":"2026-10-10","epss":0.26559,"percentile":0.97975}],"risk":13.279499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2179"},"relatedVulnerabilities":[{"id":"CVE-2016-2179","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2179","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2179","date":"2026-10-10","epss":0.26559,"percentile":0.97975}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92987","http://www.securitytracker.com/id/1036689","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5c7f5dfbaf0d2f7d946d0fe86f08e6bcb36ed0d","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2179","description":"The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c."}]},{"artifact":{"id":"17522b2e6a863e34","cpes":["cpe:2.3:a:http\\:\\/\\/fasterxml-com:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:http\\:\\/\\/fasterxml-com:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:http\\:\\/\\/fasterxml_com:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:http\\:\\/\\/fasterxml_com:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:org.codehaus.jackson:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:org.codehaus.jackson:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson-mapper-asl:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson-mapper-asl:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson_mapper_asl:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson_mapper_asl:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson-mapper:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson-mapper:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson_mapper:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson_mapper:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:http\\:\\/\\/fasterxml-com:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:http\\:\\/\\/fasterxml_com:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:org.codehaus.jackson:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:codehaus:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:codehaus:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson-mapper-asl:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson_mapper_asl:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson-mapper:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson_mapper:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:codehaus:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:1.9.13:*:*:*:*:*:*:*"],"name":"jackson-mapper-asl","purl":"pkg:maven/org.codehaus.jackson/jackson-mapper-asl@1.9.13","type":"java-archive","version":"1.9.13","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.codehaus.jackson","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/jackson-mapper-asl-1.9.13.jar","manifestName":"","pomArtifactID":"jackson-mapper-asl","archiveDigests":[{"value":"1ee2f2bed0e5dd29d1cb155a166e6f8d50bbddb7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/jackson-mapper-asl-1.9.13.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/jackson-mapper-asl-1.9.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r6j9-8759-g62w","versionConstraint":"<=1.9.13 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.codehaus.jackson:jackson-mapper-asl","version":"1.9.13"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r6j9-8759-g62w","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10172","cwe":"CWE-611","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10172","cwe":"CWE-611","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10172","date":"2026-10-10","epss":0.16606,"percentile":0.96949}],"risk":12.454500000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-10172","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172","https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r33d25a342af84102903cd9dec8338a5bcba3ecfce10505bdfe793b92@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r48a32f2dd6976d33f7a12b7e09ec7ea1895f8facba82b565587c28ac@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r4bbfa1439d7a4e1712e260bfc3d90f7cf997abfd641cccde6432d4ab@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rb8c09b14fd57d855dc21e0a037dc29258c2cbe9c1966bfff453a02e4@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rd3a34d663e2a25b9ab1e8a1a94712cd5f100f098578aec79af48161e@%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re07c51a8026c11e6e5513bfdc66d52d1c1027053e480fb8073356257@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/re646dcc2739d92117bf9a76a33c600ed3b65e8b4e9b6f441e366b72b@%3Ccommits.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html","https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r43c6f75d203b8afc4fbd6c3200db0384a18a11c59d085b1a9bb0ccfe@%3Cuser.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581@%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589@%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9@%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r1f07e61b3ebabd3e5b4aa97bf1b26d98b793fdfa29a23dac60633f55@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r4176155240cdc36aad7869932d9c29551742c7fa630f209fb4a8e649@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5b3487d363afdda80c996d7b930097383d@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r1cc8bce2cf3dfce08a64c4fa20bf38d33b56ad995cee2e382f522f83@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rb036bf32e4dacc49335e3bdc1be8e53d6f54df692ac8e2251a6884bd@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r21ac3570ce865b8f1e5d26e492aeb714a6aaa53a0c9a6f72ef181556@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r385c35a7c6f4acaacf37fe22922bb8e2aed9d322d0fa6dc1d45acddb@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r634468eb3218ab02713128ff6f4818c618622b2b3de4d958138dde49@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rd27730cfc3066dfcf15927c8e800603728d5dedf17eee1f8c6e3507c@%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5b3487d363afdda80c996d7b930097383d%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r1cc8bce2cf3dfce08a64c4fa20bf38d33b56ad995cee2e382f522f83%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r1f07e61b3ebabd3e5b4aa97bf1b26d98b793fdfa29a23dac60633f55%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r21ac3570ce865b8f1e5d26e492aeb714a6aaa53a0c9a6f72ef181556%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r33d25a342af84102903cd9dec8338a5bcba3ecfce10505bdfe793b92%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r385c35a7c6f4acaacf37fe22922bb8e2aed9d322d0fa6dc1d45acddb%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r4176155240cdc36aad7869932d9c29551742c7fa630f209fb4a8e649%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r43c6f75d203b8afc4fbd6c3200db0384a18a11c59d085b1a9bb0ccfe%40%3Cuser.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r48a32f2dd6976d33f7a12b7e09ec7ea1895f8facba82b565587c28ac%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r4bbfa1439d7a4e1712e260bfc3d90f7cf997abfd641cccde6432d4ab%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r634468eb3218ab02713128ff6f4818c618622b2b3de4d958138dde49%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rb036bf32e4dacc49335e3bdc1be8e53d6f54df692ac8e2251a6884bd%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rb8c09b14fd57d855dc21e0a037dc29258c2cbe9c1966bfff453a02e4%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/rd27730cfc3066dfcf15927c8e800603728d5dedf17eee1f8c6e3507c%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rd3a34d663e2a25b9ab1e8a1a94712cd5f100f098578aec79af48161e%40%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re07c51a8026c11e6e5513bfdc66d52d1c1027053e480fb8073356257%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/re646dcc2739d92117bf9a76a33c600ed3b65e8b4e9b6f441e366b72b%40%3Ccommits.cassandra.apache.org%3E"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r6j9-8759-g62w","description":"Improper Restriction of XML External Entity Reference in jackson-mapper-asl"},"relatedVulnerabilities":[{"id":"CVE-2019-10172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10172","cwe":"CWE-611","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10172","cwe":"CWE-611","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10172","date":"2026-10-10","epss":0.16606,"percentile":0.96949}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172","https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5b3487d363afdda80c996d7b930097383d%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r1cc8bce2cf3dfce08a64c4fa20bf38d33b56ad995cee2e382f522f83%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r1f07e61b3ebabd3e5b4aa97bf1b26d98b793fdfa29a23dac60633f55%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r21ac3570ce865b8f1e5d26e492aeb714a6aaa53a0c9a6f72ef181556%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r33d25a342af84102903cd9dec8338a5bcba3ecfce10505bdfe793b92%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r385c35a7c6f4acaacf37fe22922bb8e2aed9d322d0fa6dc1d45acddb%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r4176155240cdc36aad7869932d9c29551742c7fa630f209fb4a8e649%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r43c6f75d203b8afc4fbd6c3200db0384a18a11c59d085b1a9bb0ccfe%40%3Cuser.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r48a32f2dd6976d33f7a12b7e09ec7ea1895f8facba82b565587c28ac%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/r4bbfa1439d7a4e1712e260bfc3d90f7cf997abfd641cccde6432d4ab%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r634468eb3218ab02713128ff6f4818c618622b2b3de4d958138dde49%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E","https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rb036bf32e4dacc49335e3bdc1be8e53d6f54df692ac8e2251a6884bd%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rb8c09b14fd57d855dc21e0a037dc29258c2cbe9c1966bfff453a02e4%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/rd27730cfc3066dfcf15927c8e800603728d5dedf17eee1f8c6e3507c%40%3Ccommon-issues.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rd3a34d663e2a25b9ab1e8a1a94712cd5f100f098578aec79af48161e%40%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/re07c51a8026c11e6e5513bfdc66d52d1c1027053e480fb8073356257%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/re646dcc2739d92117bf9a76a33c600ed3b65e8b4e9b6f441e366b72b%40%3Ccommits.cassandra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10172","description":"A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes."}]},{"artifact":{"id":"b1f79060abe4923c","cpes":["cpe:2.3:a:apache:tomcat-util:8.0.23:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat_util:8.0.23:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:8.0.23:*:*:*:*:*:*:*"],"name":"tomcat-util","purl":"pkg:maven/org.apache.tomcat/tomcat-util@8.0.23","type":"java-archive","version":"8.0.23","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.tomcat","virtualPath":"/opt/atlassian/stash/lib/tomcat-util.jar","manifestName":"","pomArtifactID":"tomcat-util","archiveDigests":[{"value":"5b050f35c264ff4cb867c7d66d689f6e586ff558","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/lib/tomcat-util.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/lib/tomcat-util.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.0.41"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w3j5-q8f2-3cqq","versionConstraint":">=8.0.0-RC1,<8.0.41 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.tomcat:tomcat-util","version":"8.0.23"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w3j5-q8f2-3cqq","fix":{"state":"fixed","versions":["8.0.41"],"available":[{"date":"2025-09-03","kind":"first-observed","version":"8.0.41"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8745","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8745","date":"2026-10-10","epss":0.16038,"percentile":0.96845}],"risk":12.028500000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-8745","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://access.redhat.com/errata/RHSA-2017:0935","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4@%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://rhn.redhat.com/errata/RHSA-2017-0527.html","http://www.debian.org/security/2017/dsa-3754","http://www.debian.org/security/2017/dsa-3755","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://web.archive.org/web/20200227165932/http://www.securityfocus.com/bid/94828","https://web.archive.org/web/20200517114357/http://www.securitytracker.com/id/1037432","https://github.com/apache/tomcat/commit/143bb466cf96a89e791b7db5626055ea819dad89","https://github.com/apache/tomcat/commit/16a57bc885e212839f1d717b94b01d154a36943a","https://github.com/apache/tomcat/commit/cbc9b18a845d3c8c053ac293dffda6c6c19dd92b","https://github.com/apache/tomcat80/commit/3dd2fec73e0de1edc1d3eb1c52a01255fdfc84e7","https://security.netapp.com/advisory/ntap-20180607-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w3j5-q8f2-3cqq","description":"Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat"},"relatedVulnerabilities":[{"id":"CVE-2016-8745","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8745","cwe":"CWE-388","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8745","date":"2026-10-10","epss":0.16038,"percentile":0.96845}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0457.html","http://rhn.redhat.com/errata/RHSA-2017-0527.html","http://www.debian.org/security/2017/dsa-3754","http://www.debian.org/security/2017/dsa-3755","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/94828","http://www.securitytracker.com/id/1037432","https://access.redhat.com/errata/RHSA-2017:0455","https://access.redhat.com/errata/RHSA-2017:0456","https://access.redhat.com/errata/RHSA-2017:0935","https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/4113c05d37f37c12b8033205684f04033c5f7a9bae117d4af23b32b4%40%3Cannounce.tomcat.apache.org%3E","https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E","https://security.gentoo.org/glsa/201705-09","https://security.netapp.com/advisory/ntap-20180607-0002/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8745","description":"A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions."}]},{"artifact":{"id":"ebd1c6150f92c228","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/debian/libgssapi-krb5-2@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-10","epss":0.39969,"percentile":0.98599}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-10","epss":0.39969,"percentile":0.98599}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"d5606f7dfa73cbe3","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/debian/libk5crypto3@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-10","epss":0.39969,"percentile":0.98599}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-10","epss":0.39969,"percentile":0.98599}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"d4583f938455c8d2","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/debian/libkrb5-3@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-10","epss":0.39969,"percentile":0.98599}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-10","epss":0.39969,"percentile":0.98599}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"e0311a4922d90ba3","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12.1\\+dfsg-19\\+deb8u2:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/debian/libkrb5support0@1.12.1%2Bdfsg-19%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=krb5","type":"deb","version":"1.12.1+dfsg-19+deb8u2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12.1+dfsg-19+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12.1+dfsg-19+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"krb5","version":"1.12.1+dfsg-19+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12.1+dfsg-19+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.12.1+dfsg-19+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-10","epss":0.39969,"percentile":0.98599}],"risk":11.990699999999999,"urls":[],"severity":"Low","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-10","epss":0.39969,"percentile":0.98599}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-645p-88qh-w398","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-645p-88qh-w398","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14718","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14718","date":"2026-10-10","epss":0.12679,"percentile":0.96173}],"risk":11.918260000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-14718","https://github.com/FasterXML/jackson-databind/issues/2097","https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/6a78f88716c3c57aa74ec05764a37ab3874769a347805903b393b286@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/82b01bfb6787097427ce97cec6a7127e93718bc05d1efd5eaffc228f@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ba973114605d936be276ee6ce09dfbdbf78aa56f6cdc6e79bfa7b8df@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","http://www.securityfocus.com/bid/106601"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-645p-88qh-w398","description":"Arbitrary Code Execution in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2018-14718","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14718","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14718","date":"2026-10-10","epss":0.12679,"percentile":0.96173}],"urls":["http://www.securityfocus.com/bid/106601","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44","https://github.com/FasterXML/jackson-databind/issues/2097","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/6a78f88716c3c57aa74ec05764a37ab3874769a347805903b393b286%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/82b01bfb6787097427ce97cec6a7127e93718bc05d1efd5eaffc228f%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ba973114605d936be276ee6ce09dfbdbf78aa56f6cdc6e79bfa7b8df%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14718","description":"FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-645p-88qh-w398","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-645p-88qh-w398","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14718","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14718","date":"2026-10-10","epss":0.12679,"percentile":0.96173}],"risk":11.918260000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-14718","https://github.com/FasterXML/jackson-databind/issues/2097","https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/6a78f88716c3c57aa74ec05764a37ab3874769a347805903b393b286@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/82b01bfb6787097427ce97cec6a7127e93718bc05d1efd5eaffc228f@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ba973114605d936be276ee6ce09dfbdbf78aa56f6cdc6e79bfa7b8df@%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1@%3Ccommits.druid.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","http://www.securityfocus.com/bid/106601"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-645p-88qh-w398","description":"Arbitrary Code Execution in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2018-14718","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14718","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14718","date":"2026-10-10","epss":0.12679,"percentile":0.96173}],"urls":["http://www.securityfocus.com/bid/106601","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44","https://github.com/FasterXML/jackson-databind/issues/2097","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/6a78f88716c3c57aa74ec05764a37ab3874769a347805903b393b286%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/82b01bfb6787097427ce97cec6a7127e93718bc05d1efd5eaffc228f%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ba973114605d936be276ee6ce09dfbdbf78aa56f6cdc6e79bfa7b8df%40%3Cdev.lucene.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1d4a247329a8478073163567bbc8c8cb6b49c6bfc2bf58153a857af1%40%3Ccommits.druid.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14718","description":"FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization."}]},{"artifact":{"id":"e430d1c8a3bb02d4","cpes":["cpe:2.3:a:org.springframework.security:spring-security-core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring-security-core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring_security_core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring-security-core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring_security_core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:spring_security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:spring_security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-core:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_core:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring-security-core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_security_core:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:vmware:spring_security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:security:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:vmware:security:3.2.7.RELEASE:*:*:*:*:*:*:*"],"name":"spring-security-core","purl":"pkg:maven/org.springframework.security/spring-security-core@3.2.7.RELEASE","type":"java-archive","version":"3.2.7.RELEASE","language":"java","licenses":[],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-security-core-3.2.7.RELEASE.jar","manifestName":"","pomArtifactID":"spring-security-core","archiveDigests":[{"value":"50c170701f0cc9a99d14a50a7a97ff0c651bab66","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-security-core-3.2.7.RELEASE.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-security-core-3.2.7.RELEASE.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hh32-7344-cg2f","versionConstraint":"<5.4.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-core","version":"3.2.7.RELEASE"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hh32-7344-cg2f","fix":{"state":"fixed","versions":["5.4.11"],"available":[{"date":"2024-07-06","kind":"first-observed","version":"5.4.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22978","cwe":"CWE-863","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2022-22978","cwe":"CWE-863","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22978","date":"2026-10-10","epss":0.12351,"percentile":0.96109}],"risk":11.60994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22978","https://tanzu.vmware.com/security/cve-2022-22978","https://www.oracle.com/security-alerts/cpujul2022.html","https://spring.io/security/cve-2022-22978","https://security.netapp.com/advisory/ntap-20220707-0003","https://github.com/anchore/grype/issues/2158","https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hh32-7344-cg2f","description":"Authorization bypass in Spring Security"},"relatedVulnerabilities":[{"id":"CVE-2022-22978","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22978","cwe":"CWE-863","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2022-22978","cwe":"CWE-863","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22978","date":"2026-10-10","epss":0.12351,"percentile":0.96109}],"urls":["https://spring.io/security/cve-2022-22978"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22978","description":"In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass."}]},{"artifact":{"id":"a201411485f90695","cpes":["cpe:2.3:a:org.springframework.security:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:security:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:3.2.7.RELEASE:*:*:*:*:*:*:*"],"name":"spring-security-web","purl":"pkg:maven/org.springframework.security/spring-security-web@3.2.7.RELEASE","type":"java-archive","version":"3.2.7.RELEASE","language":"java","licenses":[],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-security-web-3.2.7.RELEASE.jar","manifestName":"","pomArtifactID":"spring-security-web","archiveDigests":[{"value":"3170f54765d6d9f99cf2d4ba7f25698d1026cf6f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-security-web-3.2.7.RELEASE.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-security-web-3.2.7.RELEASE.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.4.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hh32-7344-cg2f","versionConstraint":"<5.4.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-web","version":"3.2.7.RELEASE"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hh32-7344-cg2f","fix":{"state":"fixed","versions":["5.4.11"],"available":[{"date":"2024-10-05","kind":"first-observed","version":"5.4.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22978","cwe":"CWE-863","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2022-22978","cwe":"CWE-863","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22978","date":"2026-10-10","epss":0.12351,"percentile":0.96109}],"risk":11.60994,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22978","https://tanzu.vmware.com/security/cve-2022-22978","https://www.oracle.com/security-alerts/cpujul2022.html","https://spring.io/security/cve-2022-22978","https://security.netapp.com/advisory/ntap-20220707-0003","https://github.com/anchore/grype/issues/2158","https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hh32-7344-cg2f","description":"Authorization bypass in Spring Security"},"relatedVulnerabilities":[{"id":"CVE-2022-22978","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22978","cwe":"CWE-863","type":"Secondary","source":"security@vmware.com"},{"cve":"CVE-2022-22978","cwe":"CWE-863","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22978","date":"2026-10-10","epss":0.12351,"percentile":0.96109}],"urls":["https://spring.io/security/cve-2022-22978"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22978","description":"In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2181","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2181","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2181","cwe":"CWE-189","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2181","date":"2026-10-10","epss":0.22634,"percentile":0.97675}],"risk":11.317,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2181"},"relatedVulnerabilities":[{"id":"CVE-2016-2181","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2181","cwe":"CWE-189","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2181","date":"2026-10-10","epss":0.22634,"percentile":0.97675}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92982","http://www.securitytracker.com/id/1036690","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=1fb9fdc3027b27d8eb6a1e6a846435b070980770","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://support.f5.com/csp/article/K59298921","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2181","description":"The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2181","versionConstraint":"< 1.0.1t-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2181","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2181","cwe":"CWE-189","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2181","date":"2026-10-10","epss":0.22634,"percentile":0.97675}],"risk":11.317,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3673-1","link":"https://security-tracker.debian.org/tracker/DSA-3673-1"},{"id":"DSA-3673-2","link":"https://security-tracker.debian.org/tracker/DSA-3673-2"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2181"},"relatedVulnerabilities":[{"id":"CVE-2016-2181","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2181","cwe":"CWE-189","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2181","date":"2026-10-10","epss":0.22634,"percentile":0.97675}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92982","http://www.securitytracker.com/id/1036690","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=1fb9fdc3027b27d8eb6a1e6a846435b070980770","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://support.f5.com/csp/article/K59298921","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2181","description":"The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c."}]},{"artifact":{"id":"2cf7debe7a73e2c2","cpes":["cpe:2.3:a:apt:apt:1.0.9.8.3:*:*:*:*:*:*:*"],"name":"apt","purl":"pkg:deb/debian/apt@1.0.9.8.3?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.9.8.3","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/apt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.list"},{"path":"/var/lib/dpkg/info/apt.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.postinst"},{"path":"/var/lib/dpkg/info/apt.postrm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.postrm"},{"path":"/var/lib/dpkg/info/apt.preinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.preinst"},{"path":"/var/lib/dpkg/info/apt.prerm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.prerm"},{"path":"/var/lib/dpkg/info/apt.shlibs","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.shlibs"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.9.8.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.9.8.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"apt","version":"1.0.9.8.3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.9.8.5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.9.8.5"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-10","epss":0.14555,"percentile":0.96574}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-10","epss":0.14555,"percentile":0.96574}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"677c8dbae870140b","cpes":["cpe:2.3:a:libapt-pkg4.12:libapt-pkg4.12:1.0.9.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt-pkg4.12:libapt_pkg4.12:1.0.9.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt-pkg4.12:1.0.9.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt_pkg4.12:1.0.9.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-pkg4.12:1.0.9.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_pkg4.12:1.0.9.8.3:*:*:*:*:*:*:*"],"name":"libapt-pkg4.12","purl":"pkg:deb/debian/libapt-pkg4.12@1.0.9.8.3?arch=amd64&distro=debian-8.5&upstream=apt","type":"deb","version":"1.0.9.8.3","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-pkg4.12/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libapt-pkg4.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.9.8.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.9.8.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"apt","version":"1.0.9.8.3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.9.8.5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.9.8.5"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-10","epss":0.14555,"percentile":0.96574}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-10","epss":0.14555,"percentile":0.96574}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3735","versionConstraint":"< 1.0.1t-1+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-3735","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-10","epss":0.20968,"percentile":0.97515}],"risk":10.484,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4018-1","link":"https://security-tracker.debian.org/tracker/DSA-4018-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-3735"},"relatedVulnerabilities":[{"id":"CVE-2017-3735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-10","epss":0.20968,"percentile":0.97515}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/100515","http://www.securitytracker.com/id/1039726","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822","https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc","https://security.gentoo.org/glsa/201712-03","https://security.netapp.com/advisory/ntap-20170927-0001/","https://security.netapp.com/advisory/ntap-20171107-0002/","https://support.apple.com/HT208331","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2017/dsa-4017","https://www.debian.org/security/2017/dsa-4018","https://www.openssl.org/news/secadv/20170828.txt","https://www.openssl.org/news/secadv/20171102.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2017-14","https://www.tenable.com/security/tns-2017-15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3735","description":"While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-3735","versionConstraint":"< 1.0.1t-1+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-3735","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-10","epss":0.20968,"percentile":0.97515}],"risk":10.484,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4018-1","link":"https://security-tracker.debian.org/tracker/DSA-4018-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-3735"},"relatedVulnerabilities":[{"id":"CVE-2017-3735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-10","epss":0.20968,"percentile":0.97515}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/100515","http://www.securitytracker.com/id/1039726","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822","https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc","https://security.gentoo.org/glsa/201712-03","https://security.netapp.com/advisory/ntap-20170927-0001/","https://security.netapp.com/advisory/ntap-20171107-0002/","https://support.apple.com/HT208331","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2017/dsa-4017","https://www.debian.org/security/2017/dsa-4018","https://www.openssl.org/news/secadv/20170828.txt","https://www.openssl.org/news/secadv/20171102.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2017-14","https://www.tenable.com/security/tns-2017-15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3735","description":"While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h822-r4r5-v8jg","versionConstraint":"<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h822-r4r5-v8jg","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2023-09-14","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14540","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14540","date":"2026-10-10","epss":0.10763,"percentile":0.95739}],"risk":10.11722,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-14540","https://github.com/FasterXML/jackson-databind/blob/master/release-notes/VERSION-2.x","https://github.com/FasterXML/jackson-databind/issues/2410","https://github.com/FasterXML/jackson-databind/issues/2449","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/a4f2c9fb36642a48912cdec6836ec00e497427717c5d377f8d7ccce6@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb@%3Ccommits.hbase.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://seclists.org/bugtraq/2019/Oct/6","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/d4983c740fec7d5576b207a8c30a63d3ea7443de","https://github.com/FasterXML/jackson-databind/commit/73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT","https://security.netapp.com/advisory/ntap-20191004-0002"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h822-r4r5-v8jg","description":"Polymorphic Typing issue in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-14540","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14540","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14540","date":"2026-10-10","epss":0.10763,"percentile":0.95739}],"urls":["https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://github.com/FasterXML/jackson-databind/blob/master/release-notes/VERSION-2.x","https://github.com/FasterXML/jackson-databind/issues/2410","https://github.com/FasterXML/jackson-databind/issues/2449","https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/a4f2c9fb36642a48912cdec6836ec00e497427717c5d377f8d7ccce6%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb%40%3Ccommits.hbase.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20191004-0002/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14540","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h822-r4r5-v8jg","versionConstraint":"<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h822-r4r5-v8jg","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2023-09-14","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14540","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14540","date":"2026-10-10","epss":0.10763,"percentile":0.95739}],"risk":10.11722,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-14540","https://github.com/FasterXML/jackson-databind/blob/master/release-notes/VERSION-2.x","https://github.com/FasterXML/jackson-databind/issues/2410","https://github.com/FasterXML/jackson-databind/issues/2449","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/a4f2c9fb36642a48912cdec6836ec00e497427717c5d377f8d7ccce6@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb@%3Ccommits.hbase.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://seclists.org/bugtraq/2019/Oct/6","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/d4983c740fec7d5576b207a8c30a63d3ea7443de","https://github.com/FasterXML/jackson-databind/commit/73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT","https://security.netapp.com/advisory/ntap-20191004-0002"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h822-r4r5-v8jg","description":"Polymorphic Typing issue in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-14540","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14540","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14540","date":"2026-10-10","epss":0.10763,"percentile":0.95739}],"urls":["https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://github.com/FasterXML/jackson-databind/blob/master/release-notes/VERSION-2.x","https://github.com/FasterXML/jackson-databind/issues/2410","https://github.com/FasterXML/jackson-databind/issues/2449","https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/a4f2c9fb36642a48912cdec6836ec00e497427717c5d377f8d7ccce6%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb%40%3Ccommits.hbase.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8aaf4ee16bbaf6204731d4770d96ebb34b258cd79b491f9cdd7f2540%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20191004-0002/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14540","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig."}]},{"artifact":{"id":"d91ce551dcf6c33f","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-10","epss":0.13368,"percentile":0.96334}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-10","epss":0.13368,"percentile":0.96334}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"495e1452a66e5099","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-10","epss":0.13368,"percentile":0.96334}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-10","epss":0.13368,"percentile":0.96334}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"6dec8d97d34362ed","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-10","epss":0.13368,"percentile":0.96334}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-10","epss":0.13368,"percentile":0.96334}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c8hm-7hpq-7jhg","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c8hm-7hpq-7jhg","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2024-03-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-19362","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-19362","date":"2026-10-10","epss":0.10599,"percentile":0.95691}],"risk":9.963060000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-19362","https://github.com/FasterXML/jackson-databind/issues/2186","https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8","https://issues.apache.org/jira/browse/TINKERPOP-2121","https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html","https://seclists.org/bugtraq/2019/May/68","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","http://www.securityfocus.com/bid/107985","https://github.com/FasterXML/jackson-databind/commit/72cd4025a229fb28ec133235003dd4616f70afaa","https://security.netapp.com/advisory/ntap-20190530-0003"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c8hm-7hpq-7jhg","description":"com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data"},"relatedVulnerabilities":[{"id":"CVE-2018-19362","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-19362","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-19362","date":"2026-10-10","epss":0.10599,"percentile":0.95691}],"urls":["http://www.securityfocus.com/bid/107985","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b","https://github.com/FasterXML/jackson-databind/issues/2186","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8","https://issues.apache.org/jira/browse/TINKERPOP-2121","https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-19362","description":"FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c8hm-7hpq-7jhg","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c8hm-7hpq-7jhg","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2024-03-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-19362","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-19362","date":"2026-10-10","epss":0.10599,"percentile":0.95691}],"risk":9.963060000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-19362","https://github.com/FasterXML/jackson-databind/issues/2186","https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8","https://issues.apache.org/jira/browse/TINKERPOP-2121","https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html","https://seclists.org/bugtraq/2019/May/68","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","http://www.securityfocus.com/bid/107985","https://github.com/FasterXML/jackson-databind/commit/72cd4025a229fb28ec133235003dd4616f70afaa","https://security.netapp.com/advisory/ntap-20190530-0003"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c8hm-7hpq-7jhg","description":"com.fasterxml.jackson.core:jackson-databind vulnerable to Deserialization of Untrusted Data"},"relatedVulnerabilities":[{"id":"CVE-2018-19362","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-19362","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-19362","date":"2026-10-10","epss":0.10599,"percentile":0.95691}],"urls":["http://www.securityfocus.com/bid/107985","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b","https://github.com/FasterXML/jackson-databind/issues/2186","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8","https://issues.apache.org/jira/browse/TINKERPOP-2121","https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3%40%3Cdevnull.infra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-19362","description":"FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5r5r-6hpj-8gg9","versionConstraint":">=2.0.0,<=2.9.10.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5r5r-6hpj-8gg9","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2023-11-22","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35728","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-35728","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-35728","date":"2026-10-10","epss":0.12504,"percentile":0.96137}],"risk":9.753120000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-35728","https://github.com/FasterXML/jackson-databind/issues/2999","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210129-0007/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5r5r-6hpj-8gg9","description":"Serialization gadget exploit in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-35728","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35728","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-35728","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-35728","date":"2026-10-10","epss":0.12504,"percentile":0.96137}],"urls":["https://github.com/FasterXML/jackson-databind/issues/2999","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210129-0007/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35728","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl)."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5r5r-6hpj-8gg9","versionConstraint":">=2.0.0,<=2.9.10.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5r5r-6hpj-8gg9","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2023-11-22","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35728","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-35728","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-35728","date":"2026-10-10","epss":0.12504,"percentile":0.96137}],"risk":9.753120000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-35728","https://github.com/FasterXML/jackson-databind/issues/2999","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210129-0007/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/1ca0388c2fb37ac6a06f1c188ae89c41e3e15e84"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5r5r-6hpj-8gg9","description":"Serialization gadget exploit in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-35728","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35728","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-35728","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-35728","date":"2026-10-10","epss":0.12504,"percentile":0.96137}],"urls":["https://github.com/FasterXML/jackson-databind/issues/2999","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210129-0007/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35728","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl)."}]},{"artifact":{"id":"873b102f52bbb132","cpes":["cpe:2.3:a:apache:commons-compress:1.8.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.8.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.8.1:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.8.1","type":"java-archive","version":"1.8.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:org.apache.commons:commons-compress","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mc84-pj99-q6hh","versionConstraint":"<1.21 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.8.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mc84-pj99-q6hh","fix":{"state":"fixed","versions":["1.21"],"available":[{"date":"2021-08-03","kind":"first-observed","version":"1.21"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36090","cwe":"CWE-130","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-36090","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36090","date":"2026-10-10","epss":0.12945,"percentile":0.96234}],"risk":9.70875,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-36090","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38@%3Cuser.ant.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/07/13/4","http://www.openwall.com/lists/oss-security/2021/07/13/6","https://lists.apache.org/thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7@%3Cnotifications.james.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949@%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mc84-pj99-q6hh","description":"Improper Handling of Length Parameter Inconsistency in Compress"},"relatedVulnerabilities":[{"id":"CVE-2021-36090","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36090","cwe":"CWE-130","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-36090","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36090","date":"2026-10-10","epss":0.12945,"percentile":0.96234}],"urls":["http://www.openwall.com/lists/oss-security/2021/07/13/4","http://www.openwall.com/lists/oss-security/2021/07/13/6","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949%40%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E","https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7%40%3Cnotifications.james.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38%40%3Cuser.ant.apache.org%3E","https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-36090","description":"When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package."}]},{"artifact":{"id":"8869864fb9ead82c","cpes":["cpe:2.3:a:apache:commons-compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.9","type":"java-archive","version":"1.9","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":[{"value":"cc18955ff1e36d5abd39a14bfe82b19154330a34","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mc84-pj99-q6hh","versionConstraint":"<1.21 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mc84-pj99-q6hh","fix":{"state":"fixed","versions":["1.21"],"available":[{"date":"2021-08-03","kind":"first-observed","version":"1.21"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36090","cwe":"CWE-130","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-36090","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36090","date":"2026-10-10","epss":0.12945,"percentile":0.96234}],"risk":9.70875,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-36090","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38@%3Cuser.ant.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/07/13/4","http://www.openwall.com/lists/oss-security/2021/07/13/6","https://lists.apache.org/thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7@%3Cnotifications.james.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949@%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5@%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mc84-pj99-q6hh","description":"Improper Handling of Length Parameter Inconsistency in Compress"},"relatedVulnerabilities":[{"id":"CVE-2021-36090","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-36090","cwe":"CWE-130","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-36090","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-36090","date":"2026-10-10","epss":0.12945,"percentile":0.96234}],"urls":["http://www.openwall.com/lists/oss-security/2021/07/13/4","http://www.openwall.com/lists/oss-security/2021/07/13/6","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r0e87177f8e78b4ee453cd4d3d8f4ddec6f10d2c27707dd71e12cafc9%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r25f4c44616045085bc3cf901bb7e68e445eee53d1966fc08998fc456%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r3227b1287e5bd8db6523b862c22676b046ad8f4fc96433225f46a2bd%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r4f03c5de923e3f2a8c316248681258125140514ef3307bfe1538e1ab%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r54049b66afbca766b6763c7531e9fe7a20293a112bcb65462a134949%40%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E","https://lists.apache.org/thread.html/r75ffc7a461e7e7ae77690fa75bd47bb71365c732e0fbcc44da4f8ff5%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/r9a23d4dbf4e34d498664080bff59f2893b855eb16dae33e4aa92fa53%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb5fa2ee61828fa2e42361b58468717e84902dd71c4aea8dc0b865df7%40%3Cnotifications.james.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rbbf42642c3e4167788a7c13763d192ee049604d099681f765385d99d%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rc4134026d7d7b053d4f9f2205531122732405012c8804fd850a9b26f%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rc7df4c2f0bbe2028a1498a46d322c91184f7a369e3e4c57d9518cacf%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rdd5412a5b9a25aed2a02c3317052d38a97128314d50bc1ed36e81d38%40%3Cuser.ant.apache.org%3E","https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rf3f0a09fee197168a813966c5816157f6c600a47313a0d6813148ea6%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rf93b6bb267580e01deb7f3696f7eaca00a290c66189a658cf7230a1a%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-36090","description":"When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u14"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-3822","versionConstraint":"< 7.38.0-4+deb8u14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3822","fix":{"state":"fixed","versions":["7.38.0-4+deb8u14"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u14"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3822","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3822","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3822","date":"2026-10-10","epss":0.12873,"percentile":0.96219}],"risk":9.65475,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3822"},"relatedVulnerabilities":[{"id":"CVE-2019-3822","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3822","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3822","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3822","date":"2026-10-10","epss":0.12873,"percentile":0.96219}],"urls":["http://www.securityfocus.com/bid/106950","https://access.redhat.com/errata/RHSA-2019:3701","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2019-3822.html","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://security.gentoo.org/glsa/201903-03","https://security.netapp.com/advisory/ntap-20190315-0001/","https://security.netapp.com/advisory/ntap-20190719-0004/","https://support.f5.com/csp/article/K84141449","https://support.f5.com/csp/article/K84141449?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3882-1/","https://www.debian.org/security/2019/dsa-4386","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3822","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3822","versionConstraint":"< 7.38.0-4+deb8u14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3822","fix":{"state":"fixed","versions":["7.38.0-4+deb8u14"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u14"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3822","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3822","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3822","date":"2026-10-10","epss":0.12873,"percentile":0.96219}],"risk":9.65475,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3822"},"relatedVulnerabilities":[{"id":"CVE-2019-3822","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3822","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3822","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3822","date":"2026-10-10","epss":0.12873,"percentile":0.96219}],"urls":["http://www.securityfocus.com/bid/106950","https://access.redhat.com/errata/RHSA-2019:3701","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2019-3822.html","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://security.gentoo.org/glsa/201903-03","https://security.netapp.com/advisory/ntap-20190315-0001/","https://security.netapp.com/advisory/ntap-20190719-0004/","https://support.f5.com/csp/article/K84141449","https://support.f5.com/csp/article/K84141449?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3882-1/","https://www.debian.org/security/2019/dsa-4386","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3822","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3822","versionConstraint":"< 7.38.0-4+deb8u14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3822","fix":{"state":"fixed","versions":["7.38.0-4+deb8u14"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u14"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3822","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3822","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3822","date":"2026-10-10","epss":0.12873,"percentile":0.96219}],"risk":9.65475,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3822"},"relatedVulnerabilities":[{"id":"CVE-2019-3822","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3822","cwe":"CWE-121","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3822","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3822","date":"2026-10-10","epss":0.12873,"percentile":0.96219}],"urls":["http://www.securityfocus.com/bid/106950","https://access.redhat.com/errata/RHSA-2019:3701","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2019-3822.html","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://security.gentoo.org/glsa/201903-03","https://security.netapp.com/advisory/ntap-20190315-0001/","https://security.netapp.com/advisory/ntap-20190719-0004/","https://support.f5.com/csp/article/K84141449","https://support.f5.com/csp/article/K84141449?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3882-1/","https://www.debian.org/security/2019/dsa-4386","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3822","description":"libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header."}]},{"artifact":{"id":"4a6fc25b02170f2a","cpes":["cpe:2.3:a:apache:httpclient:4.0:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.0","type":"java-archive","version":"4.0","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:httpclient-osgi-4.0.jar:httpclient-4.0.jar","manifestName":"","pomArtifactID":"httpclient","archiveDigests":[{"value":"a76d7fd8033d48b4c67b4ccf159abb080c1059b6","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:httpclient-osgi-4.0.jar:httpclient-4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.3.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fmj5-wv96-r2ch","versionConstraint":"<4.3.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fmj5-wv96-r2ch","fix":{"state":"fixed","versions":["4.3.6"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.3.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-10-10","epss":0.1876,"percentile":0.97217}],"risk":9.379999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-5262","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fmj5-wv96-r2ch","description":"Denial of service vulnerability in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2015-5262","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-10-10","epss":0.1876,"percentile":0.97217}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors."}]},{"artifact":{"id":"9bdc2593baa750a4","cpes":["cpe:2.3:a:apache:httpclient:4.2:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.2","type":"java-archive","version":"4.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:org.apache.httpcomponents:httpclient","manifestName":"","pomArtifactID":"httpclient","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.3.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fmj5-wv96-r2ch","versionConstraint":"<4.3.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fmj5-wv96-r2ch","fix":{"state":"fixed","versions":["4.3.6"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.3.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-10-10","epss":0.1876,"percentile":0.97217}],"risk":9.379999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-5262","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fmj5-wv96-r2ch","description":"Denial of service vulnerability in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2015-5262","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-10-10","epss":0.1876,"percentile":0.97217}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors."}]},{"artifact":{"id":"b6445c8da33c33ef","cpes":["cpe:2.3:a:apache:httpclient:4.2.6:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.2.6","type":"java-archive","version":"4.2.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/httpclient-4.2.6.jar","manifestName":"","pomArtifactID":"httpclient","archiveDigests":[{"value":"e4ca30a6a3a075053a61c6fc850d2432dc012ba7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/httpclient-4.2.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.3.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fmj5-wv96-r2ch","versionConstraint":"<4.3.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.2.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fmj5-wv96-r2ch","fix":{"state":"fixed","versions":["4.3.6"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.3.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-10-10","epss":0.1876,"percentile":0.97217}],"risk":9.379999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-5262","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fmj5-wv96-r2ch","description":"Denial of service vulnerability in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2015-5262","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-10-10","epss":0.1876,"percentile":0.97217}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors."}]},{"artifact":{"id":"48b65df626e72234","cpes":["cpe:2.3:a:apache:httpclient:4.3.2:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.3.2","type":"java-archive","version":"4.3.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-httpclient-plugin-0.21.4.jar:org.apache.httpcomponents:httpclient","manifestName":"","pomArtifactID":"httpclient","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-httpclient-plugin-0.21.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.3.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fmj5-wv96-r2ch","versionConstraint":"<4.3.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fmj5-wv96-r2ch","fix":{"state":"fixed","versions":["4.3.6"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.3.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-10-10","epss":0.1876,"percentile":0.97217}],"risk":9.379999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-5262","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fmj5-wv96-r2ch","description":"Denial of service vulnerability in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2015-5262","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-10-10","epss":0.1876,"percentile":0.97217}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors."}]},{"artifact":{"id":"6bf2e5628409528b","cpes":["cpe:2.3:a:apache:httpclient:4.3.5:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.3.5","type":"java-archive","version":"4.3.5","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-universal-plugin-manager-plugin-2.18.4.jar:org.apache.httpcomponents:httpclient","manifestName":"","pomArtifactID":"httpclient","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-universal-plugin-manager-plugin-2.18.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.3.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fmj5-wv96-r2ch","versionConstraint":"<4.3.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.3.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fmj5-wv96-r2ch","fix":{"state":"fixed","versions":["4.3.6"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.3.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-10-10","epss":0.1876,"percentile":0.97217}],"risk":9.379999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-5262","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fmj5-wv96-r2ch","description":"Denial of service vulnerability in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2015-5262","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5262","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5262","date":"2026-10-10","epss":0.1876,"percentile":0.97217}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167962.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167999.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168030.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://svn.apache.org/viewvc?view=revision&revision=1626784","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securitytracker.com/id/1033743","http://www.ubuntu.com/usn/USN-2769-1","https://bugzilla.redhat.com/show_bug.cgi?id=1261538","https://issues.apache.org/jira/browse/HTTPCLIENT-1478","https://jenkins.io/security/advisory/2018-02-26/","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5262","description":"http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0739","versionConstraint":"< 1.0.1t-1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0739","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-10","epss":0.18596,"percentile":0.97198}],"risk":9.298,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4157-1","link":"https://security-tracker.debian.org/tracker/DSA-4157-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0739"},"relatedVulnerabilities":[{"id":"CVE-2018-0739","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-10","epss":0.18596,"percentile":0.97198}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103518","http://www.securityfocus.com/bid/105609","http://www.securitytracker.com/id/1040576","https://access.redhat.com/errata/RHSA-2018:3090","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:0366","https://access.redhat.com/errata/RHSA-2019:0367","https://access.redhat.com/errata/RHSA-2019:1711","https://access.redhat.com/errata/RHSA-2019:1712","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d","https://lists.debian.org/debian-lts-announce/2018/03/msg00033.html","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.gentoo.org/glsa/202007-53","https://security.netapp.com/advisory/ntap-20180330-0002/","https://security.netapp.com/advisory/ntap-20180726-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3611-1/","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2018/dsa-4157","https://www.debian.org/security/2018/dsa-4158","https://www.openssl.org/news/secadv/20180327.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-04","https://www.tenable.com/security/tns-2018-06","https://www.tenable.com/security/tns-2018-07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0739","description":"Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0739","versionConstraint":"< 1.0.1t-1+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0739","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-10","epss":0.18596,"percentile":0.97198}],"risk":9.298,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4157-1","link":"https://security-tracker.debian.org/tracker/DSA-4157-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0739"},"relatedVulnerabilities":[{"id":"CVE-2018-0739","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-10","epss":0.18596,"percentile":0.97198}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103518","http://www.securityfocus.com/bid/105609","http://www.securitytracker.com/id/1040576","https://access.redhat.com/errata/RHSA-2018:3090","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:0366","https://access.redhat.com/errata/RHSA-2019:0367","https://access.redhat.com/errata/RHSA-2019:1711","https://access.redhat.com/errata/RHSA-2019:1712","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d","https://lists.debian.org/debian-lts-announce/2018/03/msg00033.html","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.gentoo.org/glsa/202007-53","https://security.netapp.com/advisory/ntap-20180330-0002/","https://security.netapp.com/advisory/ntap-20180726-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3611-1/","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2018/dsa-4157","https://www.debian.org/security/2018/dsa-4158","https://www.openssl.org/news/secadv/20180327.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-04","https://www.tenable.com/security/tns-2018-06","https://www.tenable.com/security/tns-2018-07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0739","description":"Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)."}]},{"artifact":{"id":"873b102f52bbb132","cpes":["cpe:2.3:a:apache:commons-compress:1.8.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.8.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.8.1:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.8.1","type":"java-archive","version":"1.8.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:org.apache.commons:commons-compress","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-crv7-7245-f45f","versionConstraint":"<1.21 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.8.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-crv7-7245-f45f","fix":{"state":"fixed","versions":["1.21"],"available":[{"date":"2021-08-03","kind":"first-observed","version":"1.21"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35516","cwe":"CWE-130","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-35516","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35516","date":"2026-10-10","epss":0.12365,"percentile":0.96111}],"risk":9.27375,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-35516","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c12954f37332073c9822ca%40%3Cuser.commons.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/07/13/2","https://lists.apache.org/thread.html/rf5b1016fb15b7118b9a5e16bb0b78cb4f1dfcf7821eb137ab5757c91@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-crv7-7245-f45f","description":"Improper Handling of Length Parameter Inconsistency in Compress"},"relatedVulnerabilities":[{"id":"CVE-2021-35516","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35516","cwe":"CWE-130","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-35516","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35516","date":"2026-10-10","epss":0.12365,"percentile":0.96111}],"urls":["http://www.openwall.com/lists/oss-security/2021/07/13/2","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rf5b1016fb15b7118b9a5e16bb0b78cb4f1dfcf7821eb137ab5757c91%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c12954f37332073c9822ca%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35516","description":"When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package."}]},{"artifact":{"id":"8869864fb9ead82c","cpes":["cpe:2.3:a:apache:commons-compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.9","type":"java-archive","version":"1.9","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":[{"value":"cc18955ff1e36d5abd39a14bfe82b19154330a34","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-crv7-7245-f45f","versionConstraint":"<1.21 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-crv7-7245-f45f","fix":{"state":"fixed","versions":["1.21"],"available":[{"date":"2021-08-03","kind":"first-observed","version":"1.21"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35516","cwe":"CWE-130","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-35516","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35516","date":"2026-10-10","epss":0.12365,"percentile":0.96111}],"risk":9.27375,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-35516","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c12954f37332073c9822ca%40%3Cuser.commons.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/07/13/2","https://lists.apache.org/thread.html/rf5b1016fb15b7118b9a5e16bb0b78cb4f1dfcf7821eb137ab5757c91@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-crv7-7245-f45f","description":"Improper Handling of Length Parameter Inconsistency in Compress"},"relatedVulnerabilities":[{"id":"CVE-2021-35516","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35516","cwe":"CWE-130","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-35516","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35516","date":"2026-10-10","epss":0.12365,"percentile":0.96111}],"urls":["http://www.openwall.com/lists/oss-security/2021/07/13/2","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rf5b1016fb15b7118b9a5e16bb0b78cb4f1dfcf7821eb137ab5757c91%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf68442d67eb166f4b6cf0bbbe6c7f99098c12954f37332073c9822ca%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35516","description":"When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4gq5-ch57-c2mg","versionConstraint":">=2.0.0,<=2.7.9.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4gq5-ch57-c2mg","fix":{"state":"fixed","versions":["2.7.9.5"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"2.7.9.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14719","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14719","date":"2026-10-10","epss":0.09682,"percentile":0.95399}],"risk":9.10108,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-14719","https://github.com/FasterXML/jackson-databind/issues/2097","https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4gq5-ch57-c2mg","description":"Arbitrary Code Execution in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2018-14719","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14719","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14719","date":"2026-10-10","epss":0.09682,"percentile":0.95399}],"urls":["https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44","https://github.com/FasterXML/jackson-databind/issues/2097","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14719","description":"FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-4gq5-ch57-c2mg","versionConstraint":">=2.0.0,<=2.7.9.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-4gq5-ch57-c2mg","fix":{"state":"fixed","versions":["2.7.9.5"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"2.7.9.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14719","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14719","date":"2026-10-10","epss":0.09682,"percentile":0.95399}],"risk":9.10108,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-14719","https://github.com/FasterXML/jackson-databind/issues/2097","https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-4gq5-ch57-c2mg","description":"Arbitrary Code Execution in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2018-14719","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14719","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14719","date":"2026-10-10","epss":0.09682,"percentile":0.95399}],"urls":["https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44","https://github.com/FasterXML/jackson-databind/issues/2097","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14719","description":"FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-7167","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7167","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-10","epss":0.11737,"percentile":0.95983}],"risk":8.802750000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7167"},"relatedVulnerabilities":[{"id":"CVE-2016-7167","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-10","epss":0.11737,"percentile":0.95983}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92975","http://www.securitytracker.com/id/1036813","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.538632","https://access.redhat.com/errata/RHSA-2017:2016","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160914.html","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3IU2FRXQNU6UJIQT4NGLWWTP2GJQXO7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTH54DFOS4TSYPG5XKJDGAG4XPAR4T7M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMRWVISG7VUCYRMF23A2UHMYD72VQWAK/","https://security.gentoo.org/glsa/201701-47"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7167","description":"Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7167","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7167","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-10","epss":0.11737,"percentile":0.95983}],"risk":8.802750000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7167"},"relatedVulnerabilities":[{"id":"CVE-2016-7167","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-10","epss":0.11737,"percentile":0.95983}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92975","http://www.securitytracker.com/id/1036813","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.538632","https://access.redhat.com/errata/RHSA-2017:2016","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160914.html","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3IU2FRXQNU6UJIQT4NGLWWTP2GJQXO7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTH54DFOS4TSYPG5XKJDGAG4XPAR4T7M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMRWVISG7VUCYRMF23A2UHMYD72VQWAK/","https://security.gentoo.org/glsa/201701-47"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7167","description":"Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7167","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7167","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-10","epss":0.11737,"percentile":0.95983}],"risk":8.802750000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7167"},"relatedVulnerabilities":[{"id":"CVE-2016-7167","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-10","epss":0.11737,"percentile":0.95983}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92975","http://www.securitytracker.com/id/1036813","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.538632","https://access.redhat.com/errata/RHSA-2017:2016","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160914.html","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3IU2FRXQNU6UJIQT4NGLWWTP2GJQXO7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTH54DFOS4TSYPG5XKJDGAG4XPAR4T7M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMRWVISG7VUCYRMF23A2UHMYD72VQWAK/","https://security.gentoo.org/glsa/201701-47"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7167","description":"Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow."}]},{"artifact":{"id":"57469482e26b9740","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u12"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-18311","versionConstraint":"< 5.20.2-3+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-18311","fix":{"state":"fixed","versions":["5.20.2-3+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-10","epss":0.11676,"percentile":0.95969}],"risk":8.757000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-18311"},"relatedVulnerabilities":[{"id":"CVE-2018-18311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-10","epss":0.11676,"percentile":0.95969}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/106145","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://access.redhat.com/errata/RHSA-2019:0109","https://access.redhat.com/errata/RHSA-2019:1790","https://access.redhat.com/errata/RHSA-2019:1942","https://access.redhat.com/errata/RHSA-2019:2400","https://bugzilla.redhat.com/show_bug.cgi?id=1646730","https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://metacpan.org/changes/release/SHAY/perl-5.28.1","https://rt.perl.org/Ticket/Display.html?id=133204","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18311","description":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."}]},{"artifact":{"id":"71183f78a986047d","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18311","versionConstraint":"< 5.20.2-3+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-18311","fix":{"state":"fixed","versions":["5.20.2-3+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-10","epss":0.11676,"percentile":0.95969}],"risk":8.757000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-18311"},"relatedVulnerabilities":[{"id":"CVE-2018-18311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-10","epss":0.11676,"percentile":0.95969}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/106145","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://access.redhat.com/errata/RHSA-2019:0109","https://access.redhat.com/errata/RHSA-2019:1790","https://access.redhat.com/errata/RHSA-2019:1942","https://access.redhat.com/errata/RHSA-2019:2400","https://bugzilla.redhat.com/show_bug.cgi?id=1646730","https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://metacpan.org/changes/release/SHAY/perl-5.28.1","https://rt.perl.org/Ticket/Display.html?id=133204","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18311","description":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."}]},{"artifact":{"id":"16a442ba7a1a09d3","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u6?arch=all&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18311","versionConstraint":"< 5.20.2-3+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-18311","fix":{"state":"fixed","versions":["5.20.2-3+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-10","epss":0.11676,"percentile":0.95969}],"risk":8.757000000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-18311"},"relatedVulnerabilities":[{"id":"CVE-2018-18311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-10","epss":0.11676,"percentile":0.95969}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/106145","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://access.redhat.com/errata/RHSA-2019:0109","https://access.redhat.com/errata/RHSA-2019:1790","https://access.redhat.com/errata/RHSA-2019:1942","https://access.redhat.com/errata/RHSA-2019:2400","https://bugzilla.redhat.com/show_bug.cgi?id=1646730","https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://metacpan.org/changes/release/SHAY/perl-5.28.1","https://rt.perl.org/Ticket/Display.html?id=133204","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18311","description":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000120","versionConstraint":"< 7.38.0-4+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000120","fix":{"state":"fixed","versions":["7.38.0-4+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-10","epss":0.11608,"percentile":0.95953}],"risk":8.706,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4136-1","link":"https://security-tracker.debian.org/tracker/DSA-4136-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000120"},"relatedVulnerabilities":[{"id":"CVE-2018-1000120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-10","epss":0.11608,"percentile":0.95953}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103414","http://www.securitytracker.com/id/1040531","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-9cd6.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000120","description":"A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000120","versionConstraint":"< 7.38.0-4+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000120","fix":{"state":"fixed","versions":["7.38.0-4+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-10","epss":0.11608,"percentile":0.95953}],"risk":8.706,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4136-1","link":"https://security-tracker.debian.org/tracker/DSA-4136-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000120"},"relatedVulnerabilities":[{"id":"CVE-2018-1000120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-10","epss":0.11608,"percentile":0.95953}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103414","http://www.securitytracker.com/id/1040531","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-9cd6.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000120","description":"A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000120","versionConstraint":"< 7.38.0-4+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000120","fix":{"state":"fixed","versions":["7.38.0-4+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-10","epss":0.11608,"percentile":0.95953}],"risk":8.706,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4136-1","link":"https://security-tracker.debian.org/tracker/DSA-4136-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000120"},"relatedVulnerabilities":[{"id":"CVE-2018-1000120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-10","epss":0.11608,"percentile":0.95953}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103414","http://www.securitytracker.com/id/1040531","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-9cd6.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000120","description":"A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse."}]},{"artifact":{"id":"873b102f52bbb132","cpes":["cpe:2.3:a:apache:commons-compress:1.8.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.8.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.8.1:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.8.1","type":"java-archive","version":"1.8.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:org.apache.commons:commons-compress","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hfm-57qf-j43q","versionConstraint":"<1.21 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.8.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hfm-57qf-j43q","fix":{"state":"fixed","versions":["1.21"],"available":[{"date":"2021-08-03","kind":"first-observed","version":"1.21"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35515","cwe":"CWE-834","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-35515","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35515","date":"2026-10-10","epss":0.11567,"percentile":0.95944}],"risk":8.67525,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-35515","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/07/13/1","https://lists.apache.org/thread.html/rbaea15ddc5a7c0c6b66660f1d6403b28595e2561bb283eade7d7cd69@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hfm-57qf-j43q","description":"Excessive Iteration in Compress"},"relatedVulnerabilities":[{"id":"CVE-2021-35515","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35515","cwe":"CWE-834","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-35515","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35515","date":"2026-10-10","epss":0.11567,"percentile":0.95944}],"urls":["http://www.openwall.com/lists/oss-security/2021/07/13/1","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rbaea15ddc5a7c0c6b66660f1d6403b28595e2561bb283eade7d7cd69%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35515","description":"When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package."}]},{"artifact":{"id":"8869864fb9ead82c","cpes":["cpe:2.3:a:apache:commons-compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.9","type":"java-archive","version":"1.9","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":[{"value":"cc18955ff1e36d5abd39a14bfe82b19154330a34","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7hfm-57qf-j43q","versionConstraint":"<1.21 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7hfm-57qf-j43q","fix":{"state":"fixed","versions":["1.21"],"available":[{"date":"2021-08-03","kind":"first-observed","version":"1.21"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35515","cwe":"CWE-834","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-35515","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35515","date":"2026-10-10","epss":0.11567,"percentile":0.95944}],"risk":8.67525,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-35515","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/07/13/1","https://lists.apache.org/thread.html/rbaea15ddc5a7c0c6b66660f1d6403b28595e2561bb283eade7d7cd69@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7hfm-57qf-j43q","description":"Excessive Iteration in Compress"},"relatedVulnerabilities":[{"id":"CVE-2021-35515","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35515","cwe":"CWE-834","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-35515","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35515","date":"2026-10-10","epss":0.11567,"percentile":0.95944}],"urls":["http://www.openwall.com/lists/oss-security/2021/07/13/1","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r19ebfd71770ec0617a9ea180e321ef927b3fefb4c81ec5d1902d20ab%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rab292091eadd1ecc63c516e9541a7f241091cf2e652b8185a6059945%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rbaea15ddc5a7c0c6b66660f1d6403b28595e2561bb283eade7d7cd69%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rbe91c512c5385181149ab087b6c909825d34299f5c491c6482a2ed57%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rf2f4d7940371a7c7c5b679f50e28fc7fcc82cd00670ced87e013ac88%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35515","description":"When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1559","versionConstraint":"< 1.0.1t-1+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1559","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-10","epss":0.17139,"percentile":0.97024}],"risk":8.5695,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1559"},"relatedVulnerabilities":[{"id":"CVE-2019-1559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-10","epss":0.17139,"percentile":0.97024}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html","http://www.securityfocus.com/bid/107174","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:2437","https://access.redhat.com/errata/RHSA-2019:2439","https://access.redhat.com/errata/RHSA-2019:2471","https://access.redhat.com/errata/RHSA-2019:3929","https://access.redhat.com/errata/RHSA-2019:3931","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e","https://kc.mcafee.com/corporate/index?page=content&id=SB10282","https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://security.gentoo.org/glsa/201903-10","https://security.netapp.com/advisory/ntap-20190301-0001/","https://security.netapp.com/advisory/ntap-20190301-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://support.f5.com/csp/article/K18549143","https://support.f5.com/csp/article/K18549143?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3899-1/","https://usn.ubuntu.com/4376-2/","https://www.debian.org/security/2019/dsa-4400","https://www.openssl.org/news/secadv/20190226.txt","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-02","https://www.tenable.com/security/tns-2019-03"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1559","description":"If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u11"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1559","versionConstraint":"< 1.0.1t-1+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-1559","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-10","epss":0.17139,"percentile":0.97024}],"risk":8.5695,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1559"},"relatedVulnerabilities":[{"id":"CVE-2019-1559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-10","epss":0.17139,"percentile":0.97024}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html","http://www.securityfocus.com/bid/107174","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:2437","https://access.redhat.com/errata/RHSA-2019:2439","https://access.redhat.com/errata/RHSA-2019:2471","https://access.redhat.com/errata/RHSA-2019:3929","https://access.redhat.com/errata/RHSA-2019:3931","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e","https://kc.mcafee.com/corporate/index?page=content&id=SB10282","https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://security.gentoo.org/glsa/201903-10","https://security.netapp.com/advisory/ntap-20190301-0001/","https://security.netapp.com/advisory/ntap-20190301-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://support.f5.com/csp/article/K18549143","https://support.f5.com/csp/article/K18549143?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3899-1/","https://usn.ubuntu.com/4376-2/","https://www.debian.org/security/2019/dsa-4400","https://www.openssl.org/news/secadv/20190226.txt","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-02","https://www.tenable.com/security/tns-2019-03"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1559","description":"If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."}]},{"artifact":{"id":"7eaafe3de0d9d3c6","cpes":["cpe:2.3:a:wget:wget:1.16-1:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/debian/wget@1.16-1?arch=amd64&distro=debian-8.5","type":"deb","version":"1.16-1","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16-1+deb8u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0494","versionConstraint":"< 1.16-1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"wget","version":"1.16-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0494","fix":{"state":"fixed","versions":["1.16-1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.16-1+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0494","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0494","date":"2026-10-10","epss":0.16787,"percentile":0.96976}],"risk":8.3935,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4195-1","link":"https://security-tracker.debian.org/tracker/DSA-4195-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0494"},"relatedVulnerabilities":[{"id":"CVE-2018-0494","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0494","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0494","date":"2026-10-10","epss":0.16787,"percentile":0.96976}],"urls":["http://www.securityfocus.com/bid/104129","http://www.securitytracker.com/id/1040838","https://access.redhat.com/errata/RHSA-2018:3052","https://git.savannah.gnu.org/cgit/wget.git/commit/?id=1fc9c95ec144499e69dc8ec76dbe07799d7d82cd","https://lists.debian.org/debian-lts-announce/2018/05/msg00006.html","https://lists.gnu.org/archive/html/bug-wget/2018-05/msg00020.html","https://savannah.gnu.org/bugs/?53763","https://security.gentoo.org/glsa/201806-01","https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt","https://usn.ubuntu.com/3643-1/","https://usn.ubuntu.com/3643-2/","https://www.debian.org/security/2018/dsa-4195","https://www.exploit-db.com/exploits/44601/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0494","description":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \\r\\n sequence in a continuation line."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8817","versionConstraint":"< 7.38.0-4+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8817","fix":{"state":"fixed","versions":["7.38.0-4+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-10","epss":0.11175,"percentile":0.9586}],"risk":8.38125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4051-1","link":"https://security-tracker.debian.org/tracker/DSA-4051-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8817"},"relatedVulnerabilities":[{"id":"CVE-2017-8817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-10","epss":0.11175,"percentile":0.9586}],"urls":["http://security.cucumberlinux.com/security/details.php?id=162","http://www.securityfocus.com/bid/102057","http://www.securitytracker.com/id/1039897","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-ae72.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8817","description":"The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8817","versionConstraint":"< 7.38.0-4+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8817","fix":{"state":"fixed","versions":["7.38.0-4+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-10","epss":0.11175,"percentile":0.9586}],"risk":8.38125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4051-1","link":"https://security-tracker.debian.org/tracker/DSA-4051-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8817"},"relatedVulnerabilities":[{"id":"CVE-2017-8817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-10","epss":0.11175,"percentile":0.9586}],"urls":["http://security.cucumberlinux.com/security/details.php?id=162","http://www.securityfocus.com/bid/102057","http://www.securitytracker.com/id/1039897","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-ae72.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8817","description":"The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8817","versionConstraint":"< 7.38.0-4+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8817","fix":{"state":"fixed","versions":["7.38.0-4+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-10","epss":0.11175,"percentile":0.9586}],"risk":8.38125,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4051-1","link":"https://security-tracker.debian.org/tracker/DSA-4051-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8817"},"relatedVulnerabilities":[{"id":"CVE-2017-8817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-10","epss":0.11175,"percentile":0.9586}],"urls":["http://security.cucumberlinux.com/security/details.php?id=162","http://www.securityfocus.com/bid/102057","http://www.securitytracker.com/id/1039897","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-ae72.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8817","description":"The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u12"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-14618","versionConstraint":"< 7.38.0-4+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14618","fix":{"state":"fixed","versions":["7.38.0-4+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-10","epss":0.11115,"percentile":0.95845}],"risk":8.33625,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14618"},"relatedVulnerabilities":[{"id":"CVE-2018-14618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-10","epss":0.11115,"percentile":0.95845}],"urls":["http://www.securitytracker.com/id/1041605","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1880","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-14618.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3765-1/","https://usn.ubuntu.com/3765-2/","https://www.debian.org/security/2018/dsa-4286"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14618","description":"curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)"}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14618","versionConstraint":"< 7.38.0-4+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14618","fix":{"state":"fixed","versions":["7.38.0-4+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-10","epss":0.11115,"percentile":0.95845}],"risk":8.33625,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14618"},"relatedVulnerabilities":[{"id":"CVE-2018-14618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-10","epss":0.11115,"percentile":0.95845}],"urls":["http://www.securitytracker.com/id/1041605","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1880","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-14618.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3765-1/","https://usn.ubuntu.com/3765-2/","https://www.debian.org/security/2018/dsa-4286"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14618","description":"curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)"}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14618","versionConstraint":"< 7.38.0-4+deb8u12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14618","fix":{"state":"fixed","versions":["7.38.0-4+deb8u12"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-10","epss":0.11115,"percentile":0.95845}],"risk":8.33625,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14618"},"relatedVulnerabilities":[{"id":"CVE-2018-14618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-10","epss":0.11115,"percentile":0.95845}],"urls":["http://www.securitytracker.com/id/1041605","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1880","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-14618.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3765-1/","https://usn.ubuntu.com/3765-2/","https://www.debian.org/security/2018/dsa-4286"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14618","description":"curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)"}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gww7-p5w4-wrfv","versionConstraint":">=2.0.0,<=2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gww7-p5w4-wrfv","fix":{"state":"fixed","versions":["2.6.7.4"],"available":[{"date":"2022-04-08","kind":"first-observed","version":"2.6.7.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20330","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20330","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20330","date":"2026-10-10","epss":0.0864,"percentile":0.94994}],"risk":8.1216,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-20330","https://github.com/FasterXML/jackson-databind/issues/2526","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2","https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2c77dd6ab8344285bd8e481b57cf3029965a4b0036eefccef74cdd44@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r3f8180d0d25a7c6473ebb9714b0c1d19a73f455ae70d0c5fefc17e6c@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r428735963bee7cb99877b88d3228e28ec28af64646455c4f3e7a3c94@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r50f513772f12e1babf65c7c2b9c16425bac2d945351879e2e267517f@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5c14fdcabdeaba258857bcb67198652e4dce1d33ddc590cd81d82393@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5c3644c97f0434d1ceb48ff48897a67bdbf3baf7efbe7d04625425b3@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r5d3d10fdf28110da3f9ac1b7d08d7e252f98d7d37ce0a6bd139a2e4f@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r67f4d4c48197454b83d62afbed8bebbda3764e6e3a6e26a848961764@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r707d23bb9ee245f50aa909add0da6e8d8f24719b1278ddd99d2428b2@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7a0821b44247a1e6c6fe5f2943b90ebc4f80a8d1fb0aa9a8b29a59a2@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7fb123e7dad49af5886cfec7135c0fd5b74e4c67af029e1dc91ba744@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r8831b7fa5ca87a1cf23ee08d6dedb7877a964c1d2bd869af24056a63@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r909c822409a276ba04dc2ae31179b16f6864ba02c4f9911bdffebf95@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra2e572f568de8df5ba151e6aebb225a0629faaf0476bf7c7ed877af8@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra5ce96faec37c26b0aa15b4b6a8b1cbb145a748653e56ae83e9685d0@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra8a80dbc7319916946397823aec0d893d24713cbf7b5aee0e957298c@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb532fed78d031fff477fd840b81946f6d1200f93a63698dae65aa528@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd1f346227e11fc515914f3a7b20d81543e51e5822ba71baa0452634a@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd49cfa41bbb71ef33b53736a6af2aa8ba88c2106e30f2a34902a87d2@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd6c6fef14944f3dcfb58d35f9317eb1c32a700e86c1b5231e45d3d0b@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rfa57d9c2a27d3af14c69607fb1a3da00e758b2092aa88eb6a51b6e99@%3Cissues.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/FasterXML/jackson-databind/commit/eb254813cc822d0af015ce8fe05febf50721dc53","https://github.com/FasterXML/jackson-databind/commit/fc4214a883dc087070f25da738ef0d49c2f3387e","https://security.netapp.com/advisory/ntap-20200127-0004"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gww7-p5w4-wrfv","description":"Deserialization of Untrusted Data in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-20330","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20330","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20330","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20330","date":"2026-10-10","epss":0.0864,"percentile":0.94994}],"urls":["https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2","https://github.com/FasterXML/jackson-databind/issues/2526","https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r2c77dd6ab8344285bd8e481b57cf3029965a4b0036eefccef74cdd44%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r3f8180d0d25a7c6473ebb9714b0c1d19a73f455ae70d0c5fefc17e6c%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r428735963bee7cb99877b88d3228e28ec28af64646455c4f3e7a3c94%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r50f513772f12e1babf65c7c2b9c16425bac2d945351879e2e267517f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5c14fdcabdeaba258857bcb67198652e4dce1d33ddc590cd81d82393%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5c3644c97f0434d1ceb48ff48897a67bdbf3baf7efbe7d04625425b3%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r5d3d10fdf28110da3f9ac1b7d08d7e252f98d7d37ce0a6bd139a2e4f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r67f4d4c48197454b83d62afbed8bebbda3764e6e3a6e26a848961764%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r707d23bb9ee245f50aa909add0da6e8d8f24719b1278ddd99d2428b2%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7a0821b44247a1e6c6fe5f2943b90ebc4f80a8d1fb0aa9a8b29a59a2%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7fb123e7dad49af5886cfec7135c0fd5b74e4c67af029e1dc91ba744%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r8831b7fa5ca87a1cf23ee08d6dedb7877a964c1d2bd869af24056a63%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r909c822409a276ba04dc2ae31179b16f6864ba02c4f9911bdffebf95%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra2e572f568de8df5ba151e6aebb225a0629faaf0476bf7c7ed877af8%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra5ce96faec37c26b0aa15b4b6a8b1cbb145a748653e56ae83e9685d0%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra8a80dbc7319916946397823aec0d893d24713cbf7b5aee0e957298c%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb532fed78d031fff477fd840b81946f6d1200f93a63698dae65aa528%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd1f346227e11fc515914f3a7b20d81543e51e5822ba71baa0452634a%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd49cfa41bbb71ef33b53736a6af2aa8ba88c2106e30f2a34902a87d2%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd6c6fef14944f3dcfb58d35f9317eb1c32a700e86c1b5231e45d3d0b%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/rfa57d9c2a27d3af14c69607fb1a3da00e758b2092aa88eb6a51b6e99%40%3Cissues.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html","https://security.netapp.com/advisory/ntap-20200127-0004/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20330","description":"FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gww7-p5w4-wrfv","versionConstraint":">=2.0.0,<=2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gww7-p5w4-wrfv","fix":{"state":"fixed","versions":["2.6.7.4"],"available":[{"date":"2022-04-08","kind":"first-observed","version":"2.6.7.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20330","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20330","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20330","date":"2026-10-10","epss":0.0864,"percentile":0.94994}],"risk":8.1216,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-20330","https://github.com/FasterXML/jackson-databind/issues/2526","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2","https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2c77dd6ab8344285bd8e481b57cf3029965a4b0036eefccef74cdd44@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r3f8180d0d25a7c6473ebb9714b0c1d19a73f455ae70d0c5fefc17e6c@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r428735963bee7cb99877b88d3228e28ec28af64646455c4f3e7a3c94@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r50f513772f12e1babf65c7c2b9c16425bac2d945351879e2e267517f@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5c14fdcabdeaba258857bcb67198652e4dce1d33ddc590cd81d82393@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5c3644c97f0434d1ceb48ff48897a67bdbf3baf7efbe7d04625425b3@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r5d3d10fdf28110da3f9ac1b7d08d7e252f98d7d37ce0a6bd139a2e4f@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r67f4d4c48197454b83d62afbed8bebbda3764e6e3a6e26a848961764@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r707d23bb9ee245f50aa909add0da6e8d8f24719b1278ddd99d2428b2@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7a0821b44247a1e6c6fe5f2943b90ebc4f80a8d1fb0aa9a8b29a59a2@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7fb123e7dad49af5886cfec7135c0fd5b74e4c67af029e1dc91ba744@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r8831b7fa5ca87a1cf23ee08d6dedb7877a964c1d2bd869af24056a63@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r909c822409a276ba04dc2ae31179b16f6864ba02c4f9911bdffebf95@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra2e572f568de8df5ba151e6aebb225a0629faaf0476bf7c7ed877af8@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra5ce96faec37c26b0aa15b4b6a8b1cbb145a748653e56ae83e9685d0@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra8a80dbc7319916946397823aec0d893d24713cbf7b5aee0e957298c@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb532fed78d031fff477fd840b81946f6d1200f93a63698dae65aa528@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd1f346227e11fc515914f3a7b20d81543e51e5822ba71baa0452634a@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd49cfa41bbb71ef33b53736a6af2aa8ba88c2106e30f2a34902a87d2@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd6c6fef14944f3dcfb58d35f9317eb1c32a700e86c1b5231e45d3d0b@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rfa57d9c2a27d3af14c69607fb1a3da00e758b2092aa88eb6a51b6e99@%3Cissues.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/FasterXML/jackson-databind/commit/eb254813cc822d0af015ce8fe05febf50721dc53","https://github.com/FasterXML/jackson-databind/commit/fc4214a883dc087070f25da738ef0d49c2f3387e","https://security.netapp.com/advisory/ntap-20200127-0004"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gww7-p5w4-wrfv","description":"Deserialization of Untrusted Data in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-20330","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20330","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20330","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20330","date":"2026-10-10","epss":0.0864,"percentile":0.94994}],"urls":["https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.10.1...jackson-databind-2.9.10.2","https://github.com/FasterXML/jackson-databind/issues/2526","https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r2c77dd6ab8344285bd8e481b57cf3029965a4b0036eefccef74cdd44%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r3f8180d0d25a7c6473ebb9714b0c1d19a73f455ae70d0c5fefc17e6c%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r428735963bee7cb99877b88d3228e28ec28af64646455c4f3e7a3c94%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r50f513772f12e1babf65c7c2b9c16425bac2d945351879e2e267517f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5c14fdcabdeaba258857bcb67198652e4dce1d33ddc590cd81d82393%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5c3644c97f0434d1ceb48ff48897a67bdbf3baf7efbe7d04625425b3%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r5d3d10fdf28110da3f9ac1b7d08d7e252f98d7d37ce0a6bd139a2e4f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r67f4d4c48197454b83d62afbed8bebbda3764e6e3a6e26a848961764%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r707d23bb9ee245f50aa909add0da6e8d8f24719b1278ddd99d2428b2%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7a0821b44247a1e6c6fe5f2943b90ebc4f80a8d1fb0aa9a8b29a59a2%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r7fb123e7dad49af5886cfec7135c0fd5b74e4c67af029e1dc91ba744%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r8831b7fa5ca87a1cf23ee08d6dedb7877a964c1d2bd869af24056a63%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r909c822409a276ba04dc2ae31179b16f6864ba02c4f9911bdffebf95%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra2e572f568de8df5ba151e6aebb225a0629faaf0476bf7c7ed877af8%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra5ce96faec37c26b0aa15b4b6a8b1cbb145a748653e56ae83e9685d0%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra8a80dbc7319916946397823aec0d893d24713cbf7b5aee0e957298c%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rb532fed78d031fff477fd840b81946f6d1200f93a63698dae65aa528%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rd1f346227e11fc515914f3a7b20d81543e51e5822ba71baa0452634a%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd49cfa41bbb71ef33b53736a6af2aa8ba88c2106e30f2a34902a87d2%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd6c6fef14944f3dcfb58d35f9317eb1c32a700e86c1b5231e45d3d0b%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/rfa57d9c2a27d3af14c69607fb1a3da00e758b2092aa88eb6a51b6e99%40%3Cissues.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html","https://security.netapp.com/advisory/ntap-20200127-0004/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20330","description":"FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u151-2.6.11-2~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10355","versionConstraint":"< 7u151-2.6.11-2~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10355","fix":{"state":"fixed","versions":["7u151-2.6.11-2~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u151-2.6.11-2~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2017-10355","date":"2026-10-10","epss":0.16181,"percentile":0.96868}],"risk":8.0905,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4048-1","link":"https://security-tracker.debian.org/tracker/DSA-4048-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10355"},"relatedVulnerabilities":[{"id":"CVE-2017-10355","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-10355","date":"2026-10-10","epss":0.16181,"percentile":0.96868}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/101369","http://www.securitytracker.com/id/1039596","https://access.redhat.com/errata/RHSA-2017:2998","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3264","https://access.redhat.com/errata/RHSA-2017:3267","https://access.redhat.com/errata/RHSA-2017:3268","https://access.redhat.com/errata/RHSA-2017:3392","https://access.redhat.com/errata/RHSA-2017:3453","https://lists.debian.org/debian-lts-announce/2017/11/msg00033.html","https://security.gentoo.org/glsa/201710-31","https://security.gentoo.org/glsa/201711-14","https://security.netapp.com/advisory/ntap-20171019-0001/","https://www.debian.org/security/2017/dsa-4015","https://www.debian.org/security/2017/dsa-4048"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10355","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"57469482e26b9740","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6913","versionConstraint":"< 5.20.2-3+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6913","fix":{"state":"fixed","versions":["5.20.2-3+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-10","epss":0.10668,"percentile":0.9571}],"risk":8.001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4172-1","link":"https://security-tracker.debian.org/tracker/DSA-4172-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6913"},"relatedVulnerabilities":[{"id":"CVE-2018-6913","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-10","epss":0.10668,"percentile":0.9571}],"urls":["http://www.securityfocus.com/bid/103953","http://www.securitytracker.com/id/1040681","https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html","https://rt.perl.org/Public/Bug/Display.html?id=131844","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://usn.ubuntu.com/3625-2/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6913","description":"Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count."}]},{"artifact":{"id":"71183f78a986047d","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6913","versionConstraint":"< 5.20.2-3+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6913","fix":{"state":"fixed","versions":["5.20.2-3+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-10","epss":0.10668,"percentile":0.9571}],"risk":8.001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4172-1","link":"https://security-tracker.debian.org/tracker/DSA-4172-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6913"},"relatedVulnerabilities":[{"id":"CVE-2018-6913","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-10","epss":0.10668,"percentile":0.9571}],"urls":["http://www.securityfocus.com/bid/103953","http://www.securitytracker.com/id/1040681","https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html","https://rt.perl.org/Public/Bug/Display.html?id=131844","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://usn.ubuntu.com/3625-2/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6913","description":"Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count."}]},{"artifact":{"id":"16a442ba7a1a09d3","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u6?arch=all&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6913","versionConstraint":"< 5.20.2-3+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6913","fix":{"state":"fixed","versions":["5.20.2-3+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-10","epss":0.10668,"percentile":0.9571}],"risk":8.001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4172-1","link":"https://security-tracker.debian.org/tracker/DSA-4172-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6913"},"relatedVulnerabilities":[{"id":"CVE-2018-6913","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-10","epss":0.10668,"percentile":0.9571}],"urls":["http://www.securityfocus.com/bid/103953","http://www.securitytracker.com/id/1040681","https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html","https://rt.perl.org/Public/Bug/Display.html?id=131844","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://usn.ubuntu.com/3625-2/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6913","description":"Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count."}]},{"artifact":{"id":"873b102f52bbb132","cpes":["cpe:2.3:a:apache:commons-compress:1.8.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.8.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.8.1:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.8.1","type":"java-archive","version":"1.8.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:org.apache.commons:commons-compress","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xqfj-vm6h-2x34","versionConstraint":"<1.21 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.8.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xqfj-vm6h-2x34","fix":{"state":"fixed","versions":["1.21"],"available":[{"date":"2021-08-03","kind":"first-observed","version":"1.21"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35517","cwe":"CWE-130","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-35517","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35517","date":"2026-10-10","epss":0.10614,"percentile":0.95695}],"risk":7.9605,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-35517","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r457b2ed564860996b20d938566fe8bd4bfb7c37be8e205448ccb5975@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46@%3Cuser.ant.apache.org%3E","https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f667f2c249b6fbabada9a940%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/ra393ffdc7c90a4a37ea023946f390285693795013a642d80fba20203@%3Cannounce.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/07/13/3","http://www.openwall.com/lists/oss-security/2021/07/13/5","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r31f75743ac173b0a606f8ea6ea53f351f386c44e7bcf78ae04007c29@%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xqfj-vm6h-2x34","description":"Improper Handling of Length Parameter Inconsistency in Compress"},"relatedVulnerabilities":[{"id":"CVE-2021-35517","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35517","cwe":"CWE-130","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-35517","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35517","date":"2026-10-10","epss":0.10614,"percentile":0.95695}],"urls":["http://www.openwall.com/lists/oss-security/2021/07/13/3","http://www.openwall.com/lists/oss-security/2021/07/13/5","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r31f75743ac173b0a606f8ea6ea53f351f386c44e7bcf78ae04007c29%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/r457b2ed564860996b20d938566fe8bd4bfb7c37be8e205448ccb5975%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3E","https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f667f2c249b6fbabada9a940%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/ra393ffdc7c90a4a37ea023946f390285693795013a642d80fba20203%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35517","description":"When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package."}]},{"artifact":{"id":"8869864fb9ead82c","cpes":["cpe:2.3:a:apache:commons-compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.9","type":"java-archive","version":"1.9","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":[{"value":"cc18955ff1e36d5abd39a14bfe82b19154330a34","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.21"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xqfj-vm6h-2x34","versionConstraint":"<1.21 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xqfj-vm6h-2x34","fix":{"state":"fixed","versions":["1.21"],"available":[{"date":"2021-08-03","kind":"first-observed","version":"1.21"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35517","cwe":"CWE-130","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-35517","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35517","date":"2026-10-10","epss":0.10614,"percentile":0.95695}],"risk":7.9605,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-35517","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r457b2ed564860996b20d938566fe8bd4bfb7c37be8e205448ccb5975@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46@%3Cuser.ant.apache.org%3E","https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f667f2c249b6fbabada9a940%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/ra393ffdc7c90a4a37ea023946f390285693795013a642d80fba20203@%3Cannounce.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/07/13/3","http://www.openwall.com/lists/oss-security/2021/07/13/5","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742@%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/r31f75743ac173b0a606f8ea6ea53f351f386c44e7bcf78ae04007c29@%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b@%3Cdev.poi.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xqfj-vm6h-2x34","description":"Improper Handling of Length Parameter Inconsistency in Compress"},"relatedVulnerabilities":[{"id":"CVE-2021-35517","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35517","cwe":"CWE-130","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-35517","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35517","date":"2026-10-10","epss":0.10614,"percentile":0.95695}],"urls":["http://www.openwall.com/lists/oss-security/2021/07/13/3","http://www.openwall.com/lists/oss-security/2021/07/13/5","https://commons.apache.org/proper/commons-compress/security-reports.html","https://lists.apache.org/thread.html/r31f75743ac173b0a606f8ea6ea53f351f386c44e7bcf78ae04007c29%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/r457b2ed564860996b20d938566fe8bd4bfb7c37be8e205448ccb5975%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3E","https://lists.apache.org/thread.html/r605d906b710b95f1bbe0036a53ac6968f667f2c249b6fbabada9a940%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/r67ef3c07fe3b8c1b02d48012149d280ad6da8e4cec253b527520fb2b%40%3Cdev.poi.apache.org%3E","https://lists.apache.org/thread.html/r9f54c0caa462267e0cc68b49f141e91432b36b23348d18c65bd0d040%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/ra393ffdc7c90a4a37ea023946f390285693795013a642d80fba20203%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/racd0c0381c8404f298b226cd9db2eaae965b14c9c568224aa3f437ae%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb064d705fdfa44b5dae4c366b369ef6597951083196321773b983e71%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rb6e1fa80d34e5ada45f72655d84bfd90db0ca44ef19236a49198c88c%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rb7adf3e55359819e77230b4586521e5c6874ce5ed93384bdc14d6aee%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rba65ed5ddb0586f5b12598f55ec7db3633e7b7fede60466367fbf86a%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rd4332baaf6debd03d60deb7ec93bee49e5fdbe958cb6800dff7fb00e%40%3Cnotifications.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rfba19167efc785ad3561e7ef29f340d65ac8f0d897aed00e0731e742%40%3Cnotifications.skywalking.apache.org%3E","https://security.netapp.com/advisory/ntap-20211022-0001/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35517","description":"When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwp4-hfv6-p7hw","versionConstraint":"<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gwp4-hfv6-p7hw","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2023-09-14","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14439","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14439","date":"2026-10-10","epss":0.10564,"percentile":0.95682}],"risk":7.922999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-14439","https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2","https://github.com/FasterXML/jackson-databind/issues/2389","https://access.redhat.com/errata/RHSA-2019:3200","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20190814-0001/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwp4-hfv6-p7hw","description":"Deserialization of untrusted data in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-14439","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14439","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14439","date":"2026-10-10","epss":0.10564,"percentile":0.95682}],"urls":["https://access.redhat.com/errata/RHSA-2019:3200","https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2","https://github.com/FasterXML/jackson-databind/issues/2389","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20190814-0001/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14439","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwp4-hfv6-p7hw","versionConstraint":"<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gwp4-hfv6-p7hw","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2023-09-14","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14439","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14439","date":"2026-10-10","epss":0.10564,"percentile":0.95682}],"risk":7.922999999999999,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-14439","https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2","https://github.com/FasterXML/jackson-databind/issues/2389","https://access.redhat.com/errata/RHSA-2019:3200","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20190814-0001/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwp4-hfv6-p7hw","description":"Deserialization of untrusted data in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-14439","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14439","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14439","date":"2026-10-10","epss":0.10564,"percentile":0.95682}],"urls":["https://access.redhat.com/errata/RHSA-2019:3200","https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2","https://github.com/FasterXML/jackson-databind/issues/2389","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20190814-0001/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14439","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath."}]},{"artifact":{"id":"1598a268e59ca2aa","cpes":["cpe:2.3:a:tar:tar:1.27.1-2\\+b1:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/debian/tar@1.27.1-2%2Bb1?arch=amd64&distro=debian-8.5&upstream=tar%401.27.1-2","type":"deb","version":"1.27.1-2+b1","language":"","licenses":["sha256:9292780f2dfd11900e92ea67c7a316cf9df740b955956f87ec099a5b4f3d9136"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/tar.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[{"name":"tar","version":"1.27.1-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.27.1-2+deb8u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6321","versionConstraint":"< 1.27.1-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"tar","version":"1.27.1-2+b1"},"namespace":"debian:distro:debian:8"}},{"fix":{"suggestedVersion":"1.27.1-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6321","versionConstraint":"< 1.27.1-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"tar","version":"1.27.1-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6321","fix":{"state":"fixed","versions":["1.27.1-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.27.1-2+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6321","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-6321","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-6321","date":"2026-10-10","epss":0.15745,"percentile":0.9679}],"risk":7.8725000000000005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3702-1","link":"https://security-tracker.debian.org/tracker/DSA-3702-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6321"},"relatedVulnerabilities":[{"id":"CVE-2016-6321","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6321","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-6321","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-6321","date":"2026-10-10","epss":0.15745,"percentile":0.9679}],"urls":["http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d","http://lists.gnu.org/archive/html/bug-tar/2016-10/msg00016.html","http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html","http://seclists.org/fulldisclosure/2016/Oct/102","http://seclists.org/fulldisclosure/2016/Oct/96","http://www.debian.org/security/2016/dsa-3702","http://www.securityfocus.com/bid/93937","http://www.ubuntu.com/usn/USN-3132-1","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201611-19","https://sintonen.fi/advisories/tar-extract-pathname-bypass.proper.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6321","description":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h592-38cm-4ggp","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h592-38cm-4ggp","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2024-03-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15095","cwe":"CWE-184","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2017-15095","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15095","date":"2026-10-10","epss":0.08357,"percentile":0.94842}],"risk":7.855580000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-15095","https://github.com/FasterXML/jackson-databind/issues/1680","https://github.com/FasterXML/jackson-databind/issues/1737","https://access.redhat.com/errata/RHSA-2017:3189","https://access.redhat.com/errata/RHSA-2017:3190","https://access.redhat.com/errata/RHSA-2018:0342","https://access.redhat.com/errata/RHSA-2018:0478","https://access.redhat.com/errata/RHSA-2018:0479","https://access.redhat.com/errata/RHSA-2018:0480","https://access.redhat.com/errata/RHSA-2018:0481","https://access.redhat.com/errata/RHSA-2018:0576","https://access.redhat.com/errata/RHSA-2018:0577","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:2927","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629@%3Csolr-user.lucene.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","https://www.debian.org/security/2017/dsa-4037","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","https://github.com/FasterXML/jackson-databind/commit/a3939d36edcc755c8af55bdc1969e0fa8438f9db","https://github.com/FasterXML/jackson-databind/commit/ddfddfba6414adbecaff99684ef66eebd3a92e92","https://github.com/FasterXML/jackson-databind/commit/e865a7a4464da63ded9f4b1a2328ad85c9ded78b","https://github.com/FasterXML/jackson-databind/commit/e8f043d1aac9b82eee907e0f0c3abbdea723a935","https://web.archive.org/web/20200401000000*/http://www.securityfocus.com/bid/103880","https://web.archive.org/web/20201221192044/http://www.securitytracker.com/id/1039769","https://github.com/FasterXML/jackson-databind/commit/a054585e2175ad0882f07bcafedecfac86230f1b","https://github.com/tolbertam/jackson-databind/commit/80566a0f96b2003863f9d8f9ccc3b562001e147b","https://security.netapp.com/advisory/ntap-20171214-0003"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h592-38cm-4ggp","description":"jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution"},"relatedVulnerabilities":[{"id":"CVE-2017-15095","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15095","cwe":"CWE-184","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2017-15095","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15095","date":"2026-10-10","epss":0.08357,"percentile":0.94842}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103880","http://www.securitytracker.com/id/1039769","https://access.redhat.com/errata/RHSA-2017:3189","https://access.redhat.com/errata/RHSA-2017:3190","https://access.redhat.com/errata/RHSA-2018:0342","https://access.redhat.com/errata/RHSA-2018:0478","https://access.redhat.com/errata/RHSA-2018:0479","https://access.redhat.com/errata/RHSA-2018:0480","https://access.redhat.com/errata/RHSA-2018:0481","https://access.redhat.com/errata/RHSA-2018:0576","https://access.redhat.com/errata/RHSA-2018:0577","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:2927","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://github.com/FasterXML/jackson-databind/issues/1680","https://github.com/FasterXML/jackson-databind/issues/1737","https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","https://security.netapp.com/advisory/ntap-20171214-0003/","https://www.debian.org/security/2017/dsa-4037","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15095","description":"A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h592-38cm-4ggp","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h592-38cm-4ggp","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2024-03-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15095","cwe":"CWE-184","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2017-15095","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15095","date":"2026-10-10","epss":0.08357,"percentile":0.94842}],"risk":7.855580000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-15095","https://github.com/FasterXML/jackson-databind/issues/1680","https://github.com/FasterXML/jackson-databind/issues/1737","https://access.redhat.com/errata/RHSA-2017:3189","https://access.redhat.com/errata/RHSA-2017:3190","https://access.redhat.com/errata/RHSA-2018:0342","https://access.redhat.com/errata/RHSA-2018:0478","https://access.redhat.com/errata/RHSA-2018:0479","https://access.redhat.com/errata/RHSA-2018:0480","https://access.redhat.com/errata/RHSA-2018:0481","https://access.redhat.com/errata/RHSA-2018:0576","https://access.redhat.com/errata/RHSA-2018:0577","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:2927","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629@%3Csolr-user.lucene.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","https://www.debian.org/security/2017/dsa-4037","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","https://github.com/FasterXML/jackson-databind/commit/a3939d36edcc755c8af55bdc1969e0fa8438f9db","https://github.com/FasterXML/jackson-databind/commit/ddfddfba6414adbecaff99684ef66eebd3a92e92","https://github.com/FasterXML/jackson-databind/commit/e865a7a4464da63ded9f4b1a2328ad85c9ded78b","https://github.com/FasterXML/jackson-databind/commit/e8f043d1aac9b82eee907e0f0c3abbdea723a935","https://web.archive.org/web/20200401000000*/http://www.securityfocus.com/bid/103880","https://web.archive.org/web/20201221192044/http://www.securitytracker.com/id/1039769","https://github.com/FasterXML/jackson-databind/commit/a054585e2175ad0882f07bcafedecfac86230f1b","https://github.com/tolbertam/jackson-databind/commit/80566a0f96b2003863f9d8f9ccc3b562001e147b","https://security.netapp.com/advisory/ntap-20171214-0003"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h592-38cm-4ggp","description":"jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution"},"relatedVulnerabilities":[{"id":"CVE-2017-15095","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-15095","cwe":"CWE-184","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2017-15095","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-15095","date":"2026-10-10","epss":0.08357,"percentile":0.94842}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103880","http://www.securitytracker.com/id/1039769","https://access.redhat.com/errata/RHSA-2017:3189","https://access.redhat.com/errata/RHSA-2017:3190","https://access.redhat.com/errata/RHSA-2018:0342","https://access.redhat.com/errata/RHSA-2018:0478","https://access.redhat.com/errata/RHSA-2018:0479","https://access.redhat.com/errata/RHSA-2018:0480","https://access.redhat.com/errata/RHSA-2018:0481","https://access.redhat.com/errata/RHSA-2018:0576","https://access.redhat.com/errata/RHSA-2018:0577","https://access.redhat.com/errata/RHSA-2018:1447","https://access.redhat.com/errata/RHSA-2018:1448","https://access.redhat.com/errata/RHSA-2018:1449","https://access.redhat.com/errata/RHSA-2018:1450","https://access.redhat.com/errata/RHSA-2018:1451","https://access.redhat.com/errata/RHSA-2018:2927","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://github.com/FasterXML/jackson-databind/issues/1680","https://github.com/FasterXML/jackson-databind/issues/1737","https://lists.apache.org/thread.html/f095a791bda6c0595f691eddd0febb2d396987eec5cbd29120d8c629%40%3Csolr-user.lucene.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html","https://security.netapp.com/advisory/ntap-20171214-0003/","https://www.debian.org/security/2017/dsa-4037","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-15095","description":"A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously."}]},{"artifact":{"id":"a84b4bd055ea9172","cpes":["cpe:2.3:a:bzip2:bzip2:1.0.6-7\\+b3:*:*:*:*:*:*:*"],"name":"bzip2","purl":"pkg:deb/debian/bzip2@1.0.6-7%2Bb3?arch=amd64&distro=debian-8.5&upstream=bzip2%401.0.6-7","type":"deb","version":"1.0.6-7+b3","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bzip2/copyright","layerID":"sha256:b5412699bc1b3b3aaa14a0922fe16091b03148b75d0a0862543f0720beb92e2c","accessPath":"/usr/share/doc/bzip2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bzip2.md5sums","layerID":"sha256:b5412699bc1b3b3aaa14a0922fe16091b03148b75d0a0862543f0720beb92e2c","accessPath":"/var/lib/dpkg/info/bzip2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bzip2.list","layerID":"sha256:b5412699bc1b3b3aaa14a0922fe16091b03148b75d0a0862543f0720beb92e2c","accessPath":"/var/lib/dpkg/info/bzip2.list"}],"upstreams":[{"name":"bzip2","version":"1.0.6-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.6-7+deb8u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-3189","versionConstraint":"< 1.0.6-7+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"bzip2","version":"1.0.6-7+b3"},"namespace":"debian:distro:debian:8"}},{"fix":{"suggestedVersion":"1.0.6-7+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3189","versionConstraint":"< 1.0.6-7+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"bzip2","version":"1.0.6-7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3189","fix":{"state":"fixed","versions":["1.0.6-7+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.6-7+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-10-10","epss":0.15562,"percentile":0.96759}],"risk":7.781000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3189"},"relatedVulnerabilities":[{"id":"CVE-2016-3189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-10-10","epss":0.15562,"percentile":0.96759}],"urls":["http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","http://www.openwall.com/lists/oss-security/2016/06/20/1","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91297","http://www.securitytracker.com/id/1036132","https://bugzilla.redhat.com/show_bug.cgi?id=1319648","https://lists.apache.org/thread.html/r19b4a70ac52093115fd71d773a7a4f579599e6275a13cfcf6252c3e3%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r1dc4c9b3bd559301bdb1557245f78b8910146efb1ee534b774c5f6af%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r481cda41fefb03e04c51484ed14421d812e5ce9e0972edff10f37260%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r4ad2ea01354e394b7fa8c78a184b7e1634d51be9bc0e9e4d7e6c9305%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f7ac2bd631ccb12ced65b71ff11f94e76d05b22000795e4a7b61203%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f80cf3ade5bb73410643e885fe6b7bf9f0222daf3533e42c7ae240c%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6e3962fc9f6a79851f70cffdec5759065969cec9c6708b964464b301%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/redf17d8ad16140733b25ca402ae825d6dfa9b85f73d9fb3fd0c75d73%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rffebcbeaace56ff1fed7916700d2f414ca1366386fb1293e99b3e31e%40%3Cjira.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://security.gentoo.org/glsa/201708-08","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block."}]},{"artifact":{"id":"ea49451aea0813f9","cpes":["cpe:2.3:a:libbz2-1.0:libbz2-1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2-1.0:libbz2_1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2-1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2_1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2-1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2_1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*"],"name":"libbz2-1.0","purl":"pkg:deb/debian/libbz2-1.0@1.0.6-7%2Bb3?arch=amd64&distro=debian-8.5&upstream=bzip2%401.0.6-7","type":"deb","version":"1.0.6-7+b3","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbz2-1.0/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libbz2-1.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"bzip2","version":"1.0.6-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.6-7+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3189","versionConstraint":"< 1.0.6-7+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"bzip2","version":"1.0.6-7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3189","fix":{"state":"fixed","versions":["1.0.6-7+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.6-7+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-10-10","epss":0.15562,"percentile":0.96759}],"risk":7.781000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3189"},"relatedVulnerabilities":[{"id":"CVE-2016-3189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-10-10","epss":0.15562,"percentile":0.96759}],"urls":["http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","http://www.openwall.com/lists/oss-security/2016/06/20/1","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91297","http://www.securitytracker.com/id/1036132","https://bugzilla.redhat.com/show_bug.cgi?id=1319648","https://lists.apache.org/thread.html/r19b4a70ac52093115fd71d773a7a4f579599e6275a13cfcf6252c3e3%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r1dc4c9b3bd559301bdb1557245f78b8910146efb1ee534b774c5f6af%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r481cda41fefb03e04c51484ed14421d812e5ce9e0972edff10f37260%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r4ad2ea01354e394b7fa8c78a184b7e1634d51be9bc0e9e4d7e6c9305%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f7ac2bd631ccb12ced65b71ff11f94e76d05b22000795e4a7b61203%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f80cf3ade5bb73410643e885fe6b7bf9f0222daf3533e42c7ae240c%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6e3962fc9f6a79851f70cffdec5759065969cec9c6708b964464b301%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/redf17d8ad16140733b25ca402ae825d6dfa9b85f73d9fb3fd0c75d73%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rffebcbeaace56ff1fed7916700d2f414ca1366386fb1293e99b3e31e%40%3Cjira.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://security.gentoo.org/glsa/201708-08","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-5420","versionConstraint":"< 7.38.0-4+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-5420","fix":{"state":"fixed","versions":["7.38.0-4+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5420","cwe":"CWE-285","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5420","date":"2026-10-10","epss":0.15362,"percentile":0.96707}],"risk":7.681,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3638-1","link":"https://security-tracker.debian.org/tracker/DSA-3638-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-5420"},"relatedVulnerabilities":[{"id":"CVE-2016-5420","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5420","cwe":"CWE-285","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5420","date":"2026-10-10","epss":0.15362,"percentile":0.96707}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92309","http://www.securitytracker.com/id/1036537","http://www.securitytracker.com/id/1036739","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803B.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5420","description":"curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5420","versionConstraint":"< 7.38.0-4+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-5420","fix":{"state":"fixed","versions":["7.38.0-4+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5420","cwe":"CWE-285","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5420","date":"2026-10-10","epss":0.15362,"percentile":0.96707}],"risk":7.681,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3638-1","link":"https://security-tracker.debian.org/tracker/DSA-3638-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-5420"},"relatedVulnerabilities":[{"id":"CVE-2016-5420","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5420","cwe":"CWE-285","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5420","date":"2026-10-10","epss":0.15362,"percentile":0.96707}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92309","http://www.securitytracker.com/id/1036537","http://www.securitytracker.com/id/1036739","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803B.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5420","description":"curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate."}]},{"artifact":{"id":"d4a4e53150a9623c","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.17.2-1.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.17.2-1.1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=nss","type":"deb","version":"2:3.17.2-1.1+deb8u2","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-7182","versionConstraint":"< 2:3.26-1+debu8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"nss","version":"2:3.17.2-1.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-7182","fix":{"state":"fixed","versions":["2:3.26-1+debu8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-7182","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7182","date":"2026-10-10","epss":0.10238,"percentile":0.95582}],"risk":7.6785,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3688-1","link":"https://security-tracker.debian.org/tracker/DSA-3688-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-7182"},"relatedVulnerabilities":[{"id":"CVE-2015-7182","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-7182","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7182","date":"2026-10-10","epss":0.10238,"percentile":0.95582}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html","http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html","http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html","http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html","http://rhn.redhat.com/errata/RHSA-2015-1980.html","http://rhn.redhat.com/errata/RHSA-2015-1981.html","http://www.debian.org/security/2015/dsa-3393","http://www.debian.org/security/2015/dsa-3410","http://www.debian.org/security/2016/dsa-3688","http://www.mozilla.org/security/announce/2015/mfsa2015-133.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","http://www.securityfocus.com/bid/77416","http://www.securityfocus.com/bid/91787","http://www.securitytracker.com/id/1034069","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.399753","http://www.ubuntu.com/usn/USN-2785-1","http://www.ubuntu.com/usn/USN-2791-1","http://www.ubuntu.com/usn/USN-2819-1","https://bto.bluecoat.com/security-advisory/sa119","https://bugzilla.mozilla.org/show_bug.cgi?id=1202868","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes","https://security.gentoo.org/glsa/201512-10","https://security.gentoo.org/glsa/201605-06"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-7182","description":"Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6fpp-rgj9-8rwc","versionConstraint":"<2.7.9.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6fpp-rgj9-8rwc","fix":{"state":"fixed","versions":["2.7.9.6"],"available":[{"date":"2023-09-14","kind":"first-observed","version":"2.7.9.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14379","cwe":"CWE-1321","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14379","date":"2026-10-10","epss":0.08111,"percentile":0.94707}],"risk":7.62434,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-14379","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2","https://github.com/FasterXML/jackson-databind/issues/2387","https://access.redhat.com/errata/RHBA-2019:2824","https://access.redhat.com/errata/RHSA-2019:2743","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:2998","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/2766188be238a446a250ef76801037d452979152d85bce5e46805815@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/525bcf949a4b0da87a375cbad2680b8beccde749522f24c49befe7fb@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/689c6bcc6c7612eee71e453a115a4c8581e7b718537025d4b265783d@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/75f482fdc84abe6d0c8f438a76437c335a7bbeb5cddd4d70b4bc0cbf@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/859815b2e9f1575acbb2b260b73861c16ca49bca627fa0c46419051f@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/8723b52c2544e6cb804bc8a36622c584acd1bd6c53f2b6034c9fea54@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/99944f86abefde389da9b4040ea2327c6aa0b53a2ff9352bd4cfec17@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/d161ff3d59c5a8213400dd6afb1cce1fac4f687c32d1e0c0bfbfaa2d@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/e25e734c315f70d8876a846926cfe3bfa1a4888044f146e844caf72f@%3Ccommits.ambari.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f17f63b0f8a57e4a5759e01d25cffc0548f0b61ff5c6bfd704ad2f2a@%3Ccommits.ambari.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/","https://security.netapp.com/advisory/ntap-20190814-0001/","https://access.redhat.com/errata/RHSA-2019:3044","https://access.redhat.com/errata/RHSA-2019:3045","https://access.redhat.com/errata/RHSA-2019:3046","https://access.redhat.com/errata/RHSA-2019:3050","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2019:3292","https://access.redhat.com/errata/RHSA-2019:3297","https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2020:0727","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://support.apple.com/kb/HT213189","http://seclists.org/fulldisclosure/2022/Mar/23","https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6fpp-rgj9-8rwc","description":"Deserialization of untrusted data in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-14379","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14379","cwe":"CWE-1321","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14379","date":"2026-10-10","epss":0.08111,"percentile":0.94707}],"urls":["http://seclists.org/fulldisclosure/2022/Mar/23","https://access.redhat.com/errata/RHBA-2019:2824","https://access.redhat.com/errata/RHSA-2019:2743","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:2998","https://access.redhat.com/errata/RHSA-2019:3044","https://access.redhat.com/errata/RHSA-2019:3045","https://access.redhat.com/errata/RHSA-2019:3046","https://access.redhat.com/errata/RHSA-2019:3050","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2019:3292","https://access.redhat.com/errata/RHSA-2019:3297","https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2020:0727","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2","https://github.com/FasterXML/jackson-databind/issues/2387","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/2766188be238a446a250ef76801037d452979152d85bce5e46805815%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/525bcf949a4b0da87a375cbad2680b8beccde749522f24c49befe7fb%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/689c6bcc6c7612eee71e453a115a4c8581e7b718537025d4b265783d%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/75f482fdc84abe6d0c8f438a76437c335a7bbeb5cddd4d70b4bc0cbf%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/859815b2e9f1575acbb2b260b73861c16ca49bca627fa0c46419051f%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/8723b52c2544e6cb804bc8a36622c584acd1bd6c53f2b6034c9fea54%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/99944f86abefde389da9b4040ea2327c6aa0b53a2ff9352bd4cfec17%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/d161ff3d59c5a8213400dd6afb1cce1fac4f687c32d1e0c0bfbfaa2d%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/e25e734c315f70d8876a846926cfe3bfa1a4888044f146e844caf72f%40%3Ccommits.ambari.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f17f63b0f8a57e4a5759e01d25cffc0548f0b61ff5c6bfd704ad2f2a%40%3Ccommits.ambari.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/","https://security.netapp.com/advisory/ntap-20190814-0001/","https://support.apple.com/kb/HT213189","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14379","description":"SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6fpp-rgj9-8rwc","versionConstraint":"<2.7.9.6 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6fpp-rgj9-8rwc","fix":{"state":"fixed","versions":["2.7.9.6"],"available":[{"date":"2023-09-14","kind":"first-observed","version":"2.7.9.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14379","cwe":"CWE-1321","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14379","date":"2026-10-10","epss":0.08111,"percentile":0.94707}],"risk":7.62434,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-14379","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2","https://github.com/FasterXML/jackson-databind/issues/2387","https://access.redhat.com/errata/RHBA-2019:2824","https://access.redhat.com/errata/RHSA-2019:2743","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:2998","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/2766188be238a446a250ef76801037d452979152d85bce5e46805815@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/525bcf949a4b0da87a375cbad2680b8beccde749522f24c49befe7fb@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/689c6bcc6c7612eee71e453a115a4c8581e7b718537025d4b265783d@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/75f482fdc84abe6d0c8f438a76437c335a7bbeb5cddd4d70b4bc0cbf@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/859815b2e9f1575acbb2b260b73861c16ca49bca627fa0c46419051f@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/8723b52c2544e6cb804bc8a36622c584acd1bd6c53f2b6034c9fea54@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/99944f86abefde389da9b4040ea2327c6aa0b53a2ff9352bd4cfec17@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/d161ff3d59c5a8213400dd6afb1cce1fac4f687c32d1e0c0bfbfaa2d@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/e25e734c315f70d8876a846926cfe3bfa1a4888044f146e844caf72f@%3Ccommits.ambari.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f17f63b0f8a57e4a5759e01d25cffc0548f0b61ff5c6bfd704ad2f2a@%3Ccommits.ambari.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/","https://security.netapp.com/advisory/ntap-20190814-0001/","https://access.redhat.com/errata/RHSA-2019:3044","https://access.redhat.com/errata/RHSA-2019:3045","https://access.redhat.com/errata/RHSA-2019:3046","https://access.redhat.com/errata/RHSA-2019:3050","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2019:3292","https://access.redhat.com/errata/RHSA-2019:3297","https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2020:0727","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://support.apple.com/kb/HT213189","http://seclists.org/fulldisclosure/2022/Mar/23","https://github.com/FasterXML/jackson-databind/commit/ad418eeb974e357f2797aef64aa0e3ffaaa6125b"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6fpp-rgj9-8rwc","description":"Deserialization of untrusted data in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-14379","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14379","cwe":"CWE-1321","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14379","date":"2026-10-10","epss":0.08111,"percentile":0.94707}],"urls":["http://seclists.org/fulldisclosure/2022/Mar/23","https://access.redhat.com/errata/RHBA-2019:2824","https://access.redhat.com/errata/RHSA-2019:2743","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:2998","https://access.redhat.com/errata/RHSA-2019:3044","https://access.redhat.com/errata/RHSA-2019:3045","https://access.redhat.com/errata/RHSA-2019:3046","https://access.redhat.com/errata/RHSA-2019:3050","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2019:3292","https://access.redhat.com/errata/RHSA-2019:3297","https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2020:0727","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.1...jackson-databind-2.9.9.2","https://github.com/FasterXML/jackson-databind/issues/2387","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/2766188be238a446a250ef76801037d452979152d85bce5e46805815%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/525bcf949a4b0da87a375cbad2680b8beccde749522f24c49befe7fb%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/689c6bcc6c7612eee71e453a115a4c8581e7b718537025d4b265783d%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/75f482fdc84abe6d0c8f438a76437c335a7bbeb5cddd4d70b4bc0cbf%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/859815b2e9f1575acbb2b260b73861c16ca49bca627fa0c46419051f%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/8723b52c2544e6cb804bc8a36622c584acd1bd6c53f2b6034c9fea54%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/99944f86abefde389da9b4040ea2327c6aa0b53a2ff9352bd4cfec17%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/d161ff3d59c5a8213400dd6afb1cce1fac4f687c32d1e0c0bfbfaa2d%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/e25e734c315f70d8876a846926cfe3bfa1a4888044f146e844caf72f%40%3Ccommits.ambari.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/f17f63b0f8a57e4a5759e01d25cffc0548f0b61ff5c6bfd704ad2f2a%40%3Ccommits.ambari.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00011.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/","https://security.netapp.com/advisory/ntap-20190814-0001/","https://support.apple.com/kb/HT213189","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14379","description":"SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-5419","versionConstraint":"< 7.38.0-4+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-5419","fix":{"state":"fixed","versions":["7.38.0-4+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5419","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5419","date":"2026-10-10","epss":0.15063,"percentile":0.96656}],"risk":7.531499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3638-1","link":"https://security-tracker.debian.org/tracker/DSA-3638-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-5419"},"relatedVulnerabilities":[{"id":"CVE-2016-5419","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5419","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5419","date":"2026-10-10","epss":0.15063,"percentile":0.96656}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92292","http://www.securityfocus.com/bid/92319","http://www.securitytracker.com/id/1036538","http://www.securitytracker.com/id/1038341","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803A.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5419","description":"curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5419","versionConstraint":"< 7.38.0-4+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-5419","fix":{"state":"fixed","versions":["7.38.0-4+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5419","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5419","date":"2026-10-10","epss":0.15063,"percentile":0.96656}],"risk":7.531499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3638-1","link":"https://security-tracker.debian.org/tracker/DSA-3638-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-5419"},"relatedVulnerabilities":[{"id":"CVE-2016-5419","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5419","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5419","date":"2026-10-10","epss":0.15063,"percentile":0.96656}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92292","http://www.securityfocus.com/bid/92319","http://www.securitytracker.com/id/1036538","http://www.securitytracker.com/id/1038341","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803A.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5419","description":"curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2799","versionConstraint":"< 7u181-2.6.14-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-2799","fix":{"state":"fixed","versions":["7u181-2.6.14-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u181-2.6.14-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2799","date":"2026-10-10","epss":0.14771,"percentile":0.9661}],"risk":7.3855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4225-1","link":"https://security-tracker.debian.org/tracker/DSA-4225-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-2799"},"relatedVulnerabilities":[{"id":"CVE-2018-2799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2799","date":"2026-10-10","epss":0.14771,"percentile":0.9661}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103872","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73%40%3Cj-users.xerces.apache.org%3E","https://lists.apache.org/thread.html/b53d4601ecd9ec63c799dbe1bc5b78e0d52f4cef429da2dfe63cf06d%40%3Cfop-dev.xmlgraphics.apache.org%3E","https://lists.apache.org/thread.html/r449b5d89c7b2ba3762584cf6c38e01867d4b24706e023cf2a9911307%40%3Cuser.spark.apache.org%3E","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2799","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"3d6d44f5c8c44b3e","cpes":["cpe:2.3:a:logback-classic:logback-classic:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback-classic:logback_classic:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback_classic:logback-classic:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback_classic:logback_classic:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback-classic:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback_classic:1.0.13:*:*:*:*:*:*:*"],"name":"logback-classic","purl":"pkg:maven/ch.qos.logback/logback-classic@1.0.13","type":"java-archive","version":"1.0.13","language":"java","licenses":["http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"ch.qos.logback","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/logback-classic-1.0.13.jar","manifestName":"","pomArtifactID":"logback-classic","archiveDigests":[{"value":"6b56ec752b42ccfa1415c0361fb54b1ed7ca3db6","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/logback-classic-1.0.13.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/logback-classic-1.0.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vmfg-rjjm-rjrj","versionConstraint":"<1.2.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"ch.qos.logback:logback-classic","version":"1.0.13"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vmfg-rjjm-rjrj","fix":{"state":"fixed","versions":["1.2.0"],"available":[{"date":"2021-06-08","kind":"first-observed","version":"1.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5929","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5929","date":"2026-10-10","epss":0.07501,"percentile":0.9435}],"risk":7.05094,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-5929","https://github.com/qos-ch/logback/commit/f46044b805bca91efe5fd6afe52257cd02f775f8","https://access.redhat.com/errata/RHSA-2017:1675","https://access.redhat.com/errata/RHSA-2017:1676","https://access.redhat.com/errata/RHSA-2017:1832","https://access.redhat.com/errata/RHSA-2018:2927","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929","https://lists.apache.org/thread.html/18d509024d9aeb07f0e9579066f80bf5d4dcf20467b0c240043890d1@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/a6db61616180d73711d6db25703085940026e2dbc40f153f9d22b203@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/fa4eaaa6ff41ac6f79811e053c152ee89b7c5da8a6ac848ae97df67f@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r0bb19330e48d5ad784fa20dacba9e5538d8d60f5cd9142e0f1432b4b@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r2a08573ddee4a86dc96d469485a5843a01710ee0dc2078dfca410c79@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r2c2d57ca180e8173c90fe313ddf8eabbdcf8e3ae196f8b9f42599790@%3Ccommits.mnemonic.apache.org%3E","https://lists.apache.org/thread.html/r397bf63783240fbb5713389d3f889d287ae0c11509006700ac720037@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r4673642893562c58cbee60c151ded6c077e8a2d02296e862224a9161@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r718f27bed898008a8e037d9cc848cfc1df4d18abcbaee0cb0c142cfb@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9@%3Cdev.brooklyn.apache.org%3E","https://lists.apache.org/thread.html/ra007cec726a3927c918ec94c4316d05d1829c49eae8dc3648adc35e2@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rbb4dfca2f7e3e8f3570eec21c79832d33a51dfde6762725660b60169@%3Cdev.mnemonic.apache.org%3E","https://lists.apache.org/thread.html/rc5f0cc2f3b153bdf15ee7389d78585829abc9c7af4d322ba1085dd3e@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rd2227af3c9ada2a72dc72ed05517f5857a34d487580e1f2803922ff9@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/re9b787727291786dfe088e3cd078c7d195c0b5781e15d3cd24a3b2fc@%3Cdev.mnemonic.apache.org%3E","https://logback.qos.ch/news.html","https://lists.apache.org/thread.html/r632ec30791b441e2eb5a3129532bf1b689bf181d0ef7daf50bcf0fd6@%3Ccommits.cassandra.apache.org%3E"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vmfg-rjjm-rjrj","description":"QOS.ch Logback vulnerable to Deserialization of Untrusted Data"},"relatedVulnerabilities":[{"id":"CVE-2017-5929","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5929","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5929","date":"2026-10-10","epss":0.07501,"percentile":0.9435}],"urls":["https://access.redhat.com/errata/RHSA-2017:1675","https://access.redhat.com/errata/RHSA-2017:1676","https://access.redhat.com/errata/RHSA-2017:1832","https://access.redhat.com/errata/RHSA-2018:2927","https://lists.apache.org/thread.html/18d509024d9aeb07f0e9579066f80bf5d4dcf20467b0c240043890d1%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/a6db61616180d73711d6db25703085940026e2dbc40f153f9d22b203%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/fa4eaaa6ff41ac6f79811e053c152ee89b7c5da8a6ac848ae97df67f%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r0bb19330e48d5ad784fa20dacba9e5538d8d60f5cd9142e0f1432b4b%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r2a08573ddee4a86dc96d469485a5843a01710ee0dc2078dfca410c79%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r2c2d57ca180e8173c90fe313ddf8eabbdcf8e3ae196f8b9f42599790%40%3Ccommits.mnemonic.apache.org%3E","https://lists.apache.org/thread.html/r397bf63783240fbb5713389d3f889d287ae0c11509006700ac720037%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r4673642893562c58cbee60c151ded6c077e8a2d02296e862224a9161%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r632ec30791b441e2eb5a3129532bf1b689bf181d0ef7daf50bcf0fd6%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r718f27bed898008a8e037d9cc848cfc1df4d18abcbaee0cb0c142cfb%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3E","https://lists.apache.org/thread.html/ra007cec726a3927c918ec94c4316d05d1829c49eae8dc3648adc35e2%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rbb4dfca2f7e3e8f3570eec21c79832d33a51dfde6762725660b60169%40%3Cdev.mnemonic.apache.org%3E","https://lists.apache.org/thread.html/rc5f0cc2f3b153bdf15ee7389d78585829abc9c7af4d322ba1085dd3e%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rd2227af3c9ada2a72dc72ed05517f5857a34d487580e1f2803922ff9%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/re9b787727291786dfe088e3cd078c7d195c0b5781e15d3cd24a3b2fc%40%3Cdev.mnemonic.apache.org%3E","https://logback.qos.ch/news.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5929","description":"QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components."}]},{"artifact":{"id":"fba939281274a473","cpes":["cpe:2.3:a:logback-core:logback-core:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback-core:logback_core:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback-core:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback_core:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback-core:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback_core:1.0.13:*:*:*:*:*:*:*"],"name":"logback-core","purl":"pkg:maven/ch.qos.logback/logback-core@1.0.13","type":"java-archive","version":"1.0.13","language":"java","licenses":["http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"ch.qos.logback","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/logback-core-1.0.13.jar","manifestName":"","pomArtifactID":"logback-core","archiveDigests":[{"value":"dc6e6ce937347bd4d990fc89f4ceb469db53e45e","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/logback-core-1.0.13.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/logback-core-1.0.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.2.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vmfg-rjjm-rjrj","versionConstraint":"<1.2.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"ch.qos.logback:logback-core","version":"1.0.13"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vmfg-rjjm-rjrj","fix":{"state":"fixed","versions":["1.2.0"],"available":[{"date":"2021-06-08","kind":"first-observed","version":"1.2.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5929","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5929","date":"2026-10-10","epss":0.07501,"percentile":0.9435}],"risk":7.05094,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-5929","https://github.com/qos-ch/logback/commit/f46044b805bca91efe5fd6afe52257cd02f775f8","https://access.redhat.com/errata/RHSA-2017:1675","https://access.redhat.com/errata/RHSA-2017:1676","https://access.redhat.com/errata/RHSA-2017:1832","https://access.redhat.com/errata/RHSA-2018:2927","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5929","https://lists.apache.org/thread.html/18d509024d9aeb07f0e9579066f80bf5d4dcf20467b0c240043890d1@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/a6db61616180d73711d6db25703085940026e2dbc40f153f9d22b203@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/fa4eaaa6ff41ac6f79811e053c152ee89b7c5da8a6ac848ae97df67f@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r0bb19330e48d5ad784fa20dacba9e5538d8d60f5cd9142e0f1432b4b@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r2a08573ddee4a86dc96d469485a5843a01710ee0dc2078dfca410c79@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r2c2d57ca180e8173c90fe313ddf8eabbdcf8e3ae196f8b9f42599790@%3Ccommits.mnemonic.apache.org%3E","https://lists.apache.org/thread.html/r397bf63783240fbb5713389d3f889d287ae0c11509006700ac720037@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r4673642893562c58cbee60c151ded6c077e8a2d02296e862224a9161@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r718f27bed898008a8e037d9cc848cfc1df4d18abcbaee0cb0c142cfb@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9@%3Cdev.brooklyn.apache.org%3E","https://lists.apache.org/thread.html/ra007cec726a3927c918ec94c4316d05d1829c49eae8dc3648adc35e2@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rbb4dfca2f7e3e8f3570eec21c79832d33a51dfde6762725660b60169@%3Cdev.mnemonic.apache.org%3E","https://lists.apache.org/thread.html/rc5f0cc2f3b153bdf15ee7389d78585829abc9c7af4d322ba1085dd3e@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rd2227af3c9ada2a72dc72ed05517f5857a34d487580e1f2803922ff9@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/re9b787727291786dfe088e3cd078c7d195c0b5781e15d3cd24a3b2fc@%3Cdev.mnemonic.apache.org%3E","https://logback.qos.ch/news.html","https://lists.apache.org/thread.html/r632ec30791b441e2eb5a3129532bf1b689bf181d0ef7daf50bcf0fd6@%3Ccommits.cassandra.apache.org%3E"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vmfg-rjjm-rjrj","description":"QOS.ch Logback vulnerable to Deserialization of Untrusted Data"},"relatedVulnerabilities":[{"id":"CVE-2017-5929","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5929","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5929","date":"2026-10-10","epss":0.07501,"percentile":0.9435}],"urls":["https://access.redhat.com/errata/RHSA-2017:1675","https://access.redhat.com/errata/RHSA-2017:1676","https://access.redhat.com/errata/RHSA-2017:1832","https://access.redhat.com/errata/RHSA-2018:2927","https://lists.apache.org/thread.html/18d509024d9aeb07f0e9579066f80bf5d4dcf20467b0c240043890d1%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/a6db61616180d73711d6db25703085940026e2dbc40f153f9d22b203%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/fa4eaaa6ff41ac6f79811e053c152ee89b7c5da8a6ac848ae97df67f%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r0bb19330e48d5ad784fa20dacba9e5538d8d60f5cd9142e0f1432b4b%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r2a08573ddee4a86dc96d469485a5843a01710ee0dc2078dfca410c79%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r2c2d57ca180e8173c90fe313ddf8eabbdcf8e3ae196f8b9f42599790%40%3Ccommits.mnemonic.apache.org%3E","https://lists.apache.org/thread.html/r397bf63783240fbb5713389d3f889d287ae0c11509006700ac720037%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r4673642893562c58cbee60c151ded6c077e8a2d02296e862224a9161%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r632ec30791b441e2eb5a3129532bf1b689bf181d0ef7daf50bcf0fd6%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r718f27bed898008a8e037d9cc848cfc1df4d18abcbaee0cb0c142cfb%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/r967953a14e05016bc4bcae9ef3dd92e770181158b4246976ed8295c9%40%3Cdev.brooklyn.apache.org%3E","https://lists.apache.org/thread.html/ra007cec726a3927c918ec94c4316d05d1829c49eae8dc3648adc35e2%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rbb4dfca2f7e3e8f3570eec21c79832d33a51dfde6762725660b60169%40%3Cdev.mnemonic.apache.org%3E","https://lists.apache.org/thread.html/rc5f0cc2f3b153bdf15ee7389d78585829abc9c7af4d322ba1085dd3e%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/rd2227af3c9ada2a72dc72ed05517f5857a34d487580e1f2803922ff9%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/re9b787727291786dfe088e3cd078c7d195c0b5781e15d3cd24a3b2fc%40%3Cdev.mnemonic.apache.org%3E","https://logback.qos.ch/news.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5929","description":"QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components."}]},{"artifact":{"id":"c6e6b72ebd423a03","cpes":["cpe:2.3:a:libx11-6:libx11-6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11-6:libx11_6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11-6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11_6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_6:2\\:1.6.2-3:*:*:*:*:*:*:*"],"name":"libx11-6","purl":"pkg:deb/debian/libx11-6@2%3A1.6.2-3?arch=amd64&distro=debian-8.5&upstream=libx11","type":"deb","version":"2:1.6.2-3","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-6/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libx11-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-3+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14600","versionConstraint":"< 2:1.6.2-3+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libx11","version":"2:1.6.2-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14600","fix":{"state":"fixed","versions":["2:1.6.2-3+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.6.2-3+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14600","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14600","date":"2026-10-10","epss":0.09341,"percentile":0.95279}],"risk":7.005750000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14600"},"relatedVulnerabilities":[{"id":"CVE-2018-14600","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14600","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14600","date":"2026-10-10","epss":0.09341,"percentile":0.95279}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/21/6","http://www.securityfocus.com/bid/105177","http://www.securitytracker.com/id/1041543","https://access.redhat.com/errata/RHSA-2019:2079","https://bugzilla.suse.com/show_bug.cgi?id=1102068","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=dbf72805fd9d7b1846fe9a11b46f3994bfc27fea","https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html","https://lists.x.org/archives/xorg-announce/2018-August/002916.html","https://security.gentoo.org/glsa/201811-01","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14600","description":"An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution."}]},{"artifact":{"id":"ad2e7a145e934793","cpes":["cpe:2.3:a:libx11-data:libx11-data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11-data:libx11_data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11-data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11_data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_data:2\\:1.6.2-3:*:*:*:*:*:*:*"],"name":"libx11-data","purl":"pkg:deb/debian/libx11-data@2%3A1.6.2-3?arch=all&distro=debian-8.5&upstream=libx11","type":"deb","version":"2:1.6.2-3","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-data/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libx11-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-data.list"}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-3+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14600","versionConstraint":"< 2:1.6.2-3+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libx11","version":"2:1.6.2-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14600","fix":{"state":"fixed","versions":["2:1.6.2-3+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.6.2-3+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14600","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14600","date":"2026-10-10","epss":0.09341,"percentile":0.95279}],"risk":7.005750000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14600"},"relatedVulnerabilities":[{"id":"CVE-2018-14600","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14600","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14600","date":"2026-10-10","epss":0.09341,"percentile":0.95279}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/21/6","http://www.securityfocus.com/bid/105177","http://www.securitytracker.com/id/1041543","https://access.redhat.com/errata/RHSA-2019:2079","https://bugzilla.suse.com/show_bug.cgi?id=1102068","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=dbf72805fd9d7b1846fe9a11b46f3994bfc27fea","https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html","https://lists.x.org/archives/xorg-announce/2018-August/002916.html","https://security.gentoo.org/glsa/201811-01","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14600","description":"An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution."}]},{"artifact":{"id":"186b3e415d3e4868","cpes":["cpe:2.3:a:libx11-xcb1:libx11-xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11-xcb1:libx11_xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11-xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11_xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*"],"name":"libx11-xcb1","purl":"pkg:deb/debian/libx11-xcb1@2%3A1.6.2-3?arch=amd64&distro=debian-8.5&upstream=libx11","type":"deb","version":"2:1.6.2-3","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-xcb1/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libx11-xcb1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-xcb1:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-xcb1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-3+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14600","versionConstraint":"< 2:1.6.2-3+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libx11","version":"2:1.6.2-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14600","fix":{"state":"fixed","versions":["2:1.6.2-3+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.6.2-3+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14600","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14600","date":"2026-10-10","epss":0.09341,"percentile":0.95279}],"risk":7.005750000000001,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14600"},"relatedVulnerabilities":[{"id":"CVE-2018-14600","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14600","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14600","date":"2026-10-10","epss":0.09341,"percentile":0.95279}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/21/6","http://www.securityfocus.com/bid/105177","http://www.securitytracker.com/id/1041543","https://access.redhat.com/errata/RHSA-2019:2079","https://bugzilla.suse.com/show_bug.cgi?id=1102068","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=dbf72805fd9d7b1846fe9a11b46f3994bfc27fea","https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html","https://lists.x.org/archives/xorg-announce/2018-August/002916.html","https://security.gentoo.org/glsa/201811-01","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14600","description":"An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3855","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3855","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3855","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3855","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3855","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3855","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3855","date":"2026-10-10","epss":0.09294,"percentile":0.95263}],"risk":6.970499999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3855"},"relatedVulnerabilities":[{"id":"CVE-2019-3855","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3855","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3855","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3855","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3855","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3855","date":"2026-10-10","epss":0.09294,"percentile":0.95263}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html","http://seclists.org/fulldisclosure/2019/Sep/42","http://www.openwall.com/lists/oss-security/2019/03/18/3","http://www.securityfocus.com/bid/107485","https://access.redhat.com/errata/RHSA-2019:0679","https://access.redhat.com/errata/RHSA-2019:1175","https://access.redhat.com/errata/RHSA-2019:1652","https://access.redhat.com/errata/RHSA-2019:1791","https://access.redhat.com/errata/RHSA-2019:1943","https://access.redhat.com/errata/RHSA-2019:2399","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3855","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/","https://seclists.org/bugtraq/2019/Apr/25","https://seclists.org/bugtraq/2019/Mar/25","https://seclists.org/bugtraq/2019/Sep/49","https://security.netapp.com/advisory/ntap-20190327-0005/","https://support.apple.com/kb/HT210609","https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3855.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3855","description":"An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f9xh-2qgp-cq57","versionConstraint":">=2.0.0,<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f9xh-2qgp-cq57","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36188","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36188","date":"2026-10-10","epss":0.08787,"percentile":0.95065}],"risk":6.853860000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36188","https://github.com/FasterXML/jackson-databind/issues/2996","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/33d96c13fe18a2dad01b19ce195548c9acea9da4"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f9xh-2qgp-cq57","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36188","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36188","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36188","date":"2026-10-10","epss":0.08787,"percentile":0.95065}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2996","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36188","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f9xh-2qgp-cq57","versionConstraint":">=2.0.0,<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f9xh-2qgp-cq57","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36188","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36188","date":"2026-10-10","epss":0.08787,"percentile":0.95065}],"risk":6.853860000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36188","https://github.com/FasterXML/jackson-databind/issues/2996","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/33d96c13fe18a2dad01b19ce195548c9acea9da4"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f9xh-2qgp-cq57","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36188","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36188","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36188","date":"2026-10-10","epss":0.08787,"percentile":0.95065}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2996","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36188","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource."}]},{"artifact":{"id":"8c073cd8c0fb539c","cpes":["cpe:2.3:a:metastuff-ltd-:dom4j:1.4:*:*:*:*:*:*:*","cpe:2.3:a:metastuff_ltd_:dom4j:1.4:*:*:*:*:*:*:*","cpe:2.3:a:org.dom4j:dom4j:1.4:*:*:*:*:*:*:*","cpe:2.3:a:dom4j:dom4j:1.4:*:*:*:*:*:*:*"],"name":"dom4j","purl":"pkg:maven/org.dom4j/dom4j@1.4","type":"java-archive","version":"1.4","language":"java","licenses":[],"metadata":{"pomGroupID":"org.dom4j","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/dom4j-1.4.jar","manifestName":"","pomArtifactID":"dom4j","archiveDigests":[{"value":"8decb7e2c04c9340375aaf7dd43a7a6a9b9a46b1","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/dom4j-1.4.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/dom4j-1.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.0.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hwj3-m3p6-hj38","versionConstraint":"<2.0.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.dom4j:dom4j","version":"1.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hwj3-m3p6-hj38","fix":{"state":"fixed","versions":["2.0.3"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"2.0.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10683","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10683","date":"2026-10-10","epss":0.07269,"percentile":0.94213}],"risk":6.83286,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-10683","https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658","https://bugzilla.redhat.com/show_bug.cgi?id=1694235","https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html","https://github.com/dom4j/dom4j/releases/tag/version-2.1.3","https://security.netapp.com/advisory/ntap-20200518-0002/","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html","https://github.com/dom4j/dom4j/commit/1707bf3d898a8ada3b213acb0e3b38f16eaae73d","https://www.oracle.com/security-alerts/cpujul2020.html","https://github.com/dom4j/dom4j/issues/87","https://github.com/dom4j/dom4j/commits/version-2.0.3","https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8@%3Cdev.velocity.apache.org%3E","https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32@%3Cdev.velocity.apache.org%3E","https://usn.ubuntu.com/4575-1/","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51@%3Cnotifications.freemarker.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hwj3-m3p6-hj38","description":"dom4j allows External Entities by default which might enable XXE attacks"},"relatedVulnerabilities":[{"id":"CVE-2020-10683","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10683","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10683","date":"2026-10-10","epss":0.07269,"percentile":0.94213}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00061.html","https://bugzilla.redhat.com/show_bug.cgi?id=1694235","https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html","https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658","https://github.com/dom4j/dom4j/commits/version-2.0.3","https://github.com/dom4j/dom4j/issues/87","https://github.com/dom4j/dom4j/releases/tag/version-2.1.3","https://lists.apache.org/thread.html/r51f3f9801058e47153c0ad9bc6209d57a592fc0e7aefd787760911b8%40%3Cdev.velocity.apache.org%3E","https://lists.apache.org/thread.html/r91c64cd51e68e97d524395474eaa25362d564572276b9917fcbf5c32%40%3Cdev.velocity.apache.org%3E","https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E","https://security.netapp.com/advisory/ntap-20200518-0002/","https://usn.ubuntu.com/4575-1/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10683","description":"dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fqwf-pjwf-7vqv","versionConstraint":">=2.0.0,<2.6.7.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fqwf-pjwf-7vqv","fix":{"state":"fixed","versions":["2.6.7.4"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10673","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10673","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10673","date":"2026-10-10","epss":0.08028,"percentile":0.94654}],"risk":6.542820000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-10673","https://github.com/FasterXML/jackson-databind/issues/2660","https://lists.debian.org/debian-lts-announce/2020/03/msg00027.html","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://github.com/FasterXML/jackson-databind/commit/1645efbd392989cf015f459a91c999e59c921b15","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20200403-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fqwf-pjwf-7vqv","description":"jackson-databind mishandles the interaction between serialization gadgets and typing"},"relatedVulnerabilities":[{"id":"CVE-2020-10673","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10673","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10673","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10673","date":"2026-10-10","epss":0.08028,"percentile":0.94654}],"urls":["https://github.com/FasterXML/jackson-databind/issues/2660","https://lists.debian.org/debian-lts-announce/2020/03/msg00027.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20200403-0002/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10673","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus)."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fqwf-pjwf-7vqv","versionConstraint":">=2.0.0,<2.6.7.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fqwf-pjwf-7vqv","fix":{"state":"fixed","versions":["2.6.7.4"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10673","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10673","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10673","date":"2026-10-10","epss":0.08028,"percentile":0.94654}],"risk":6.542820000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-10673","https://github.com/FasterXML/jackson-databind/issues/2660","https://lists.debian.org/debian-lts-announce/2020/03/msg00027.html","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://github.com/FasterXML/jackson-databind/commit/1645efbd392989cf015f459a91c999e59c921b15","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20200403-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fqwf-pjwf-7vqv","description":"jackson-databind mishandles the interaction between serialization gadgets and typing"},"relatedVulnerabilities":[{"id":"CVE-2020-10673","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10673","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10673","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10673","date":"2026-10-10","epss":0.08028,"percentile":0.94654}],"urls":["https://github.com/FasterXML/jackson-databind/issues/2660","https://lists.debian.org/debian-lts-announce/2020/03/msg00027.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20200403-0002/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10673","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus)."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m6x4-97wx-4q27","versionConstraint":">=2.0.0,<2.9.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-m6x4-97wx-4q27","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2021-12-10","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36184","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36184","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36184","date":"2026-10-10","epss":0.08356,"percentile":0.9484}],"risk":6.5176799999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36184","https://github.com/FasterXML/jackson-databind/issues/2998","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/567194c53ae91f0a14dc27239afb739b1c10448a"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m6x4-97wx-4q27","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36184","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36184","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36184","date":"2026-10-10","epss":0.08356,"percentile":0.9484}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2998","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36184","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m6x4-97wx-4q27","versionConstraint":">=2.0.0,<2.9.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-m6x4-97wx-4q27","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2021-12-10","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36184","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36184","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36184","date":"2026-10-10","epss":0.08356,"percentile":0.9484}],"risk":6.5176799999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36184","https://github.com/FasterXML/jackson-databind/issues/2998","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/567194c53ae91f0a14dc27239afb739b1c10448a"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m6x4-97wx-4q27","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36184","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36184","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36184","date":"2026-10-10","epss":0.08356,"percentile":0.9484}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2998","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36184","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource."}]},{"artifact":{"id":"db8ea562e46a3772","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10989","versionConstraint":"< 3.8.7.1-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10989","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10989","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10989","date":"2026-10-10","epss":0.08609,"percentile":0.9498}],"risk":6.4567499999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10989"},"relatedVulnerabilities":[{"id":"CVE-2017-10989","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10989","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10989","date":"2026-10-10","epss":0.08609,"percentile":0.9498}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00050.html","http://marc.info/?l=sqlite-users&m=149933696214713&w=2","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/99502","http://www.securitytracker.com/id/1039427","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2405","https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937","https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html","https://sqlite.org/src/info/66de6f4a","https://sqlite.org/src/vpatch?from=0db20efe201736b3&to=66de6f4a9504ec26","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10989","description":"The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact."}]},{"artifact":{"id":"313fa3578fbafcd9","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u2:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"2.9.1+dfsg1-5+deb8u2","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-4658","versionConstraint":"< 2.9.1+dfsg1-5+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4658","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-4658","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4658","date":"2026-10-10","epss":0.08559,"percentile":0.94951}],"risk":6.41925,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3744-1","link":"https://security-tracker.debian.org/tracker/DSA-3744-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4658"},"relatedVulnerabilities":[{"id":"CVE-2016-4658","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4658","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4658","date":"2026-10-10","epss":0.08559,"percentile":0.94951}],"urls":["http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html","http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html","http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html","http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html","http://www.securityfocus.com/bid/93054","http://www.securitytracker.com/id/1036858","http://www.securitytracker.com/id/1038623","https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b","https://security.gentoo.org/glsa/201701-37","https://support.apple.com/HT207141","https://support.apple.com/HT207142","https://support.apple.com/HT207143","https://support.apple.com/HT207170"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4658","description":"xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8816","versionConstraint":"< 7.38.0-4+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8816","fix":{"state":"fixed","versions":["7.38.0-4+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8816","date":"2026-10-10","epss":0.08523,"percentile":0.94932}],"risk":6.392249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4051-1","link":"https://security-tracker.debian.org/tracker/DSA-4051-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8816"},"relatedVulnerabilities":[{"id":"CVE-2017-8816","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8816","date":"2026-10-10","epss":0.08523,"percentile":0.94932}],"urls":["http://security.cucumberlinux.com/security/details.php?id=161","http://www.securityfocus.com/bid/101998","http://www.securitytracker.com/id/1039896","http://www.securitytracker.com/id/1040608","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-12e7.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8816","description":"The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8816","versionConstraint":"< 7.38.0-4+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8816","fix":{"state":"fixed","versions":["7.38.0-4+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8816","date":"2026-10-10","epss":0.08523,"percentile":0.94932}],"risk":6.392249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4051-1","link":"https://security-tracker.debian.org/tracker/DSA-4051-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8816"},"relatedVulnerabilities":[{"id":"CVE-2017-8816","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8816","date":"2026-10-10","epss":0.08523,"percentile":0.94932}],"urls":["http://security.cucumberlinux.com/security/details.php?id=161","http://www.securityfocus.com/bid/101998","http://www.securitytracker.com/id/1039896","http://www.securitytracker.com/id/1040608","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-12e7.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8816","description":"The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8816","versionConstraint":"< 7.38.0-4+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8816","fix":{"state":"fixed","versions":["7.38.0-4+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8816","date":"2026-10-10","epss":0.08523,"percentile":0.94932}],"risk":6.392249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4051-1","link":"https://security-tracker.debian.org/tracker/DSA-4051-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8816"},"relatedVulnerabilities":[{"id":"CVE-2017-8816","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8816","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8816","date":"2026-10-10","epss":0.08523,"percentile":0.94932}],"urls":["http://security.cucumberlinux.com/security/details.php?id=161","http://www.securityfocus.com/bid/101998","http://www.securitytracker.com/id/1039896","http://www.securitytracker.com/id/1040608","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-12e7.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8816","description":"The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields."}]},{"artifact":{"id":"1b0f8262f0bac2cd","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8386","versionConstraint":"< 1:2.1.4-2.1+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8386","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u3"}]},"cvss":[],"epss":[{"cve":"CVE-2017-8386","date":"2026-10-10","epss":0.12387,"percentile":0.96116}],"risk":6.193499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3848-1","link":"https://security-tracker.debian.org/tracker/DSA-3848-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8386"},"relatedVulnerabilities":[{"id":"CVE-2017-8386","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-8386","date":"2026-10-10","epss":0.12387,"percentile":0.96116}],"urls":["http://lists.opensuse.org/opensuse-updates/2017-05/msg00090.html","http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com/","http://www.debian.org/security/2017/dsa-3848","http://www.securityfocus.com/bid/98409","http://www.securitytracker.com/id/1038479","http://www.ubuntu.com/usn/USN-3287-1","https://access.redhat.com/errata/RHSA-2017:2004","https://access.redhat.com/errata/RHSA-2017:2491","https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/","https://kernel.googlesource.com/pub/scm/git/git/+/3ec804490a265f4c418a321428c12f3f18b7eff5","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ISHYFLM2ACYHHY3JHCLF75X7UF4ZMDM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPYRN7APMHY4ZFDPAKD22J5R4QJFY2JP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDS3LSJJ3YGGQYIVPKQDVOCXWDSF6JGF/","https://security.gentoo.org/glsa/201706-04"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8386","description":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character."}]},{"artifact":{"id":"c887d301ab2f172c","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u2?arch=all&distro=debian-8.5&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8386","versionConstraint":"< 1:2.1.4-2.1+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8386","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u3"}]},"cvss":[],"epss":[{"cve":"CVE-2017-8386","date":"2026-10-10","epss":0.12387,"percentile":0.96116}],"risk":6.193499999999999,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3848-1","link":"https://security-tracker.debian.org/tracker/DSA-3848-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8386"},"relatedVulnerabilities":[{"id":"CVE-2017-8386","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-8386","date":"2026-10-10","epss":0.12387,"percentile":0.96116}],"urls":["http://lists.opensuse.org/opensuse-updates/2017-05/msg00090.html","http://public-inbox.org/git/xmqq8tm5ziat.fsf%40gitster.mtv.corp.google.com/","http://www.debian.org/security/2017/dsa-3848","http://www.securityfocus.com/bid/98409","http://www.securitytracker.com/id/1038479","http://www.ubuntu.com/usn/USN-3287-1","https://access.redhat.com/errata/RHSA-2017:2004","https://access.redhat.com/errata/RHSA-2017:2491","https://insinuator.net/2017/05/git-shell-bypass-by-abusing-less-cve-2017-8386/","https://kernel.googlesource.com/pub/scm/git/git/+/3ec804490a265f4c418a321428c12f3f18b7eff5","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ISHYFLM2ACYHHY3JHCLF75X7UF4ZMDM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPYRN7APMHY4ZFDPAKD22J5R4QJFY2JP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDS3LSJJ3YGGQYIVPKQDVOCXWDSF6JGF/","https://security.gentoo.org/glsa/201706-04"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8386","description":"git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0734","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0734","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-10","epss":0.12154,"percentile":0.96068}],"risk":6.077,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0734"},"relatedVulnerabilities":[{"id":"CVE-2018-0734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-10","epss":0.12154,"percentile":0.96068}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://www.securityfocus.com/bid/105758","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:3700","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20181030.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-16","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0734","description":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0734","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0734","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-10","epss":0.12154,"percentile":0.96068}],"risk":6.077,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0734"},"relatedVulnerabilities":[{"id":"CVE-2018-0734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-10","epss":0.12154,"percentile":0.96068}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://www.securityfocus.com/bid/105758","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:3700","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20181030.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-16","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0734","description":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r3gr-cxrf-hg25","versionConstraint":">=2.0.0,<=2.9.10.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r3gr-cxrf-hg25","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2021-12-10","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35491","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35491","date":"2026-10-10","epss":0.0775,"percentile":0.94504}],"risk":6.045,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-35491","https://github.com/FasterXML/jackson-databind/issues/2986","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/41b8bdb5ccc1d8edb71acf1c8234da235a24249d","https://security.netapp.com/advisory/ntap-20210122-0005"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r3gr-cxrf-hg25","description":"Serialization gadgets exploit in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-35491","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35491","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35491","date":"2026-10-10","epss":0.0775,"percentile":0.94504}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2986","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210122-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35491","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r3gr-cxrf-hg25","versionConstraint":">=2.0.0,<=2.9.10.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r3gr-cxrf-hg25","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2021-12-10","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35491","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35491","date":"2026-10-10","epss":0.0775,"percentile":0.94504}],"risk":6.045,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-35491","https://github.com/FasterXML/jackson-databind/issues/2986","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/41b8bdb5ccc1d8edb71acf1c8234da235a24249d","https://security.netapp.com/advisory/ntap-20210122-0005"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r3gr-cxrf-hg25","description":"Serialization gadgets exploit in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-35491","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35491","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35491","date":"2026-10-10","epss":0.0775,"percentile":0.94504}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2986","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210122-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35491","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u221-2.6.18-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-2698","versionConstraint":"< 7u221-2.6.18-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-2698","fix":{"state":"fixed","versions":["7u221-2.6.18-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u221-2.6.18-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2019-2698","date":"2026-10-10","epss":0.12013,"percentile":0.96045}],"risk":6.0065,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-2698"},"relatedVulnerabilities":[{"id":"CVE-2019-2698","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-2698","date":"2026-10-10","epss":0.12013,"percentile":0.96045}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:1146","https://access.redhat.com/errata/RHSA-2019:1163","https://access.redhat.com/errata/RHSA-2019:1164","https://access.redhat.com/errata/RHSA-2019:1165","https://access.redhat.com/errata/RHSA-2019:1166","https://access.redhat.com/errata/RHSA-2019:1238","https://access.redhat.com/errata/RHSA-2019:1325","https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html","https://seclists.org/bugtraq/2019/May/75","https://security.gentoo.org/glsa/201908-10","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us","https://usn.ubuntu.com/3975-1/","https://www.debian.org/security/2019/dsa-4453"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-2698","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"a84b4bd055ea9172","cpes":["cpe:2.3:a:bzip2:bzip2:1.0.6-7\\+b3:*:*:*:*:*:*:*"],"name":"bzip2","purl":"pkg:deb/debian/bzip2@1.0.6-7%2Bb3?arch=amd64&distro=debian-8.5&upstream=bzip2%401.0.6-7","type":"deb","version":"1.0.6-7+b3","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bzip2/copyright","layerID":"sha256:b5412699bc1b3b3aaa14a0922fe16091b03148b75d0a0862543f0720beb92e2c","accessPath":"/usr/share/doc/bzip2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bzip2.md5sums","layerID":"sha256:b5412699bc1b3b3aaa14a0922fe16091b03148b75d0a0862543f0720beb92e2c","accessPath":"/var/lib/dpkg/info/bzip2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bzip2.list","layerID":"sha256:b5412699bc1b3b3aaa14a0922fe16091b03148b75d0a0862543f0720beb92e2c","accessPath":"/var/lib/dpkg/info/bzip2.list"}],"upstreams":[{"name":"bzip2","version":"1.0.6-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.6-7+deb8u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-12900","versionConstraint":"< 1.0.6-7+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"bzip2","version":"1.0.6-7+b3"},"namespace":"debian:distro:debian:8"}},{"fix":{"suggestedVersion":"1.0.6-7+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-12900","versionConstraint":"< 1.0.6-7+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"bzip2","version":"1.0.6-7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-12900","fix":{"state":"fixed","versions":["1.0.6-7+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.6-7+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-10-10","epss":0.07977,"percentile":0.94627}],"risk":5.982749999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-12900"},"relatedVulnerabilities":[{"id":"CVE-2019-12900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-10-10","epss":0.07977,"percentile":0.94627}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html","http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html","http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://support.f5.com/csp/article/K68713584?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://usn.ubuntu.com/4146-1/","https://usn.ubuntu.com/4146-2/","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12900","description":"BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors."}]},{"artifact":{"id":"ea49451aea0813f9","cpes":["cpe:2.3:a:libbz2-1.0:libbz2-1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2-1.0:libbz2_1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2-1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2_1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2-1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2_1.0:1.0.6-7\\+b3:*:*:*:*:*:*:*"],"name":"libbz2-1.0","purl":"pkg:deb/debian/libbz2-1.0@1.0.6-7%2Bb3?arch=amd64&distro=debian-8.5&upstream=bzip2%401.0.6-7","type":"deb","version":"1.0.6-7+b3","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbz2-1.0/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libbz2-1.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"bzip2","version":"1.0.6-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.6-7+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-12900","versionConstraint":"< 1.0.6-7+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"bzip2","version":"1.0.6-7"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-12900","fix":{"state":"fixed","versions":["1.0.6-7+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.6-7+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-10-10","epss":0.07977,"percentile":0.94627}],"risk":5.982749999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-12900"},"relatedVulnerabilities":[{"id":"CVE-2019-12900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-10-10","epss":0.07977,"percentile":0.94627}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html","http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html","http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://support.f5.com/csp/article/K68713584?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://usn.ubuntu.com/4146-1/","https://usn.ubuntu.com/4146-2/","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12900","description":"BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors."}]},{"artifact":{"id":"ab73b3438fae35e9","cpes":["cpe:2.3:a:libvorbis0a:libvorbis0a:1.3.4-2:*:*:*:*:*:*:*"],"name":"libvorbis0a","purl":"pkg:deb/debian/libvorbis0a@1.3.4-2?arch=amd64&distro=debian-8.5&upstream=libvorbis","type":"deb","version":"1.3.4-2","language":"","licenses":["sha256:b409692e039c3f1cb597a309c583dbe6d3f97fc7993904e6a478ab15b196d625"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libvorbis0a/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libvorbis0a/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libvorbis0a:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libvorbis0a:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libvorbis"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.3.4-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5146","versionConstraint":"< 1.3.4-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libvorbis","version":"1.3.4-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5146","fix":{"state":"fixed","versions":["1.3.4-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.3.4-2+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5146","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5146","date":"2026-10-10","epss":0.11905,"percentile":0.96019}],"risk":5.952500000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4140-1","link":"https://security-tracker.debian.org/tracker/DSA-4140-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5146"},"relatedVulnerabilities":[{"id":"CVE-2018-5146","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5146","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5146","date":"2026-10-10","epss":0.11905,"percentile":0.96019}],"urls":["http://www.securityfocus.com/bid/103432","http://www.securitytracker.com/id/1040544","https://access.redhat.com/errata/RHSA-2018:0549","https://access.redhat.com/errata/RHSA-2018:0647","https://access.redhat.com/errata/RHSA-2018:0648","https://access.redhat.com/errata/RHSA-2018:0649","https://access.redhat.com/errata/RHSA-2018:1058","https://bugzilla.mozilla.org/show_bug.cgi?id=1446062","https://lists.debian.org/debian-lts-announce/2018/03/msg00022.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00029.html","https://lists.debian.org/debian-lts-announce/2018/04/msg00033.html","https://security.gentoo.org/glsa/201811-13","https://usn.ubuntu.com/3545-1/","https://usn.ubuntu.com/3599-1/","https://usn.ubuntu.com/3604-1/","https://www.debian.org/security/2018/dsa-4140","https://www.debian.org/security/2018/dsa-4143","https://www.debian.org/security/2018/dsa-4155","https://www.mozilla.org/security/advisories/mfsa2018-08/","https://www.mozilla.org/security/advisories/mfsa2018-09/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5146","description":"An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7."}]},{"artifact":{"id":"82f26c9b346d0322","cpes":["cpe:2.3:a:libvorbisenc2:libvorbisenc2:1.3.4-2:*:*:*:*:*:*:*"],"name":"libvorbisenc2","purl":"pkg:deb/debian/libvorbisenc2@1.3.4-2?arch=amd64&distro=debian-8.5&upstream=libvorbis","type":"deb","version":"1.3.4-2","language":"","licenses":["sha256:b409692e039c3f1cb597a309c583dbe6d3f97fc7993904e6a478ab15b196d625"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libvorbisenc2/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libvorbisenc2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libvorbisenc2:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libvorbisenc2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libvorbis"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.3.4-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5146","versionConstraint":"< 1.3.4-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libvorbis","version":"1.3.4-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-5146","fix":{"state":"fixed","versions":["1.3.4-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.3.4-2+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5146","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5146","date":"2026-10-10","epss":0.11905,"percentile":0.96019}],"risk":5.952500000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4140-1","link":"https://security-tracker.debian.org/tracker/DSA-4140-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-5146"},"relatedVulnerabilities":[{"id":"CVE-2018-5146","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5146","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5146","date":"2026-10-10","epss":0.11905,"percentile":0.96019}],"urls":["http://www.securityfocus.com/bid/103432","http://www.securitytracker.com/id/1040544","https://access.redhat.com/errata/RHSA-2018:0549","https://access.redhat.com/errata/RHSA-2018:0647","https://access.redhat.com/errata/RHSA-2018:0648","https://access.redhat.com/errata/RHSA-2018:0649","https://access.redhat.com/errata/RHSA-2018:1058","https://bugzilla.mozilla.org/show_bug.cgi?id=1446062","https://lists.debian.org/debian-lts-announce/2018/03/msg00022.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00029.html","https://lists.debian.org/debian-lts-announce/2018/04/msg00033.html","https://security.gentoo.org/glsa/201811-13","https://usn.ubuntu.com/3545-1/","https://usn.ubuntu.com/3599-1/","https://usn.ubuntu.com/3604-1/","https://www.debian.org/security/2018/dsa-4140","https://www.debian.org/security/2018/dsa-4143","https://www.debian.org/security/2018/dsa-4155","https://www.mozilla.org/security/advisories/mfsa2018-08/","https://www.mozilla.org/security/advisories/mfsa2018-09/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5146","description":"An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cmfg-87vq-g5g4","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cmfg-87vq-g5g4","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2024-03-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12814","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12814","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12814","date":"2026-10-10","epss":0.10902,"percentile":0.95781}],"risk":5.941590000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-12814","https://github.com/FasterXML/jackson-databind/issues/2341","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:3044","https://access.redhat.com/errata/RHSA-2019:3045","https://access.redhat.com/errata/RHSA-2019:3046","https://access.redhat.com/errata/RHSA-2019:3050","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2019:3292","https://access.redhat.com/errata/RHSA-2019:3297","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/129da0204c876f746636018751a086cc581e0e07bcdeb3ee22ff5731@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/15a55e1d837fa686db493137cc0330c7ee1089ed9a9eea7ae7151ef1@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/1e04d9381c801b31ab28dec813c31c304b2a596b2a3707fa5462c5c0@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/28be28ffd6471d230943a255c36fe196a54ef5afc494a4781d16e37c@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/2ff264b6a94c5363a35c4c88fa93216f60ec54d1d973ed6b76a9f560@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/4b832d1327703d6b287a6d223307f8f884d798821209a10647e93324@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/71f9ffd92410a889e27b95a219eaa843fd820f8550898633d85d4ea3@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/8fe2983f6d9fee0aa737e4bd24483f8f5cf9b938b9adad0c4e79b2a4@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/a3ae8a8c5e32c413cd27071d3a204166050bf79ce7f1299f6866338f@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/a62aa2706105d68f1c02023fe24aaa3c13b4d8a1826181fed07d9682@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/a78239b1f11cddfa86e4edee19064c40b6272214630bfef070c37957@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0a2b2cca072650dbd5882719976c3d353972c44f6736ddf0ba95209@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/b148fa2e9ef468c4de00de255dd728b74e2a97d935f8ced31eb41ba2@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/bf20574dbc2db255f1fd489942b5720f675e32a2c4f44eb6a36060cd@%3Ccommits.accumulo.apache.org%3E","https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe@%3Cnotifications.geode.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/eff7280055fc717ea8129cd28a9dd57b8446d00b36260c1caee10b87@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/5f7c69bba07a7155adde130d9dee2e54a54f1fa5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC","https://security.netapp.com/advisory/ntap-20190625-0006"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cmfg-87vq-g5g4","description":"Deserialization of untrusted data in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-12814","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12814","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12814","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12814","date":"2026-10-10","epss":0.10902,"percentile":0.95781}],"urls":["https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:3044","https://access.redhat.com/errata/RHSA-2019:3045","https://access.redhat.com/errata/RHSA-2019:3046","https://access.redhat.com/errata/RHSA-2019:3050","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2019:3292","https://access.redhat.com/errata/RHSA-2019:3297","https://github.com/FasterXML/jackson-databind/issues/2341","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/129da0204c876f746636018751a086cc581e0e07bcdeb3ee22ff5731%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/15a55e1d837fa686db493137cc0330c7ee1089ed9a9eea7ae7151ef1%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/1e04d9381c801b31ab28dec813c31c304b2a596b2a3707fa5462c5c0%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/28be28ffd6471d230943a255c36fe196a54ef5afc494a4781d16e37c%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/2ff264b6a94c5363a35c4c88fa93216f60ec54d1d973ed6b76a9f560%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/4b832d1327703d6b287a6d223307f8f884d798821209a10647e93324%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/71f9ffd92410a889e27b95a219eaa843fd820f8550898633d85d4ea3%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/8fe2983f6d9fee0aa737e4bd24483f8f5cf9b938b9adad0c4e79b2a4%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/a3ae8a8c5e32c413cd27071d3a204166050bf79ce7f1299f6866338f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/a62aa2706105d68f1c02023fe24aaa3c13b4d8a1826181fed07d9682%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/a78239b1f11cddfa86e4edee19064c40b6272214630bfef070c37957%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0a2b2cca072650dbd5882719976c3d353972c44f6736ddf0ba95209%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/b148fa2e9ef468c4de00de255dd728b74e2a97d935f8ced31eb41ba2%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/bf20574dbc2db255f1fd489942b5720f675e32a2c4f44eb6a36060cd%40%3Ccommits.accumulo.apache.org%3E","https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe%40%3Cnotifications.geode.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/eff7280055fc717ea8129cd28a9dd57b8446d00b36260c1caee10b87%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/","https://security.netapp.com/advisory/ntap-20190625-0006/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12814","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cmfg-87vq-g5g4","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cmfg-87vq-g5g4","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2024-03-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12814","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12814","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12814","date":"2026-10-10","epss":0.10902,"percentile":0.95781}],"risk":5.941590000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-12814","https://github.com/FasterXML/jackson-databind/issues/2341","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:3044","https://access.redhat.com/errata/RHSA-2019:3045","https://access.redhat.com/errata/RHSA-2019:3046","https://access.redhat.com/errata/RHSA-2019:3050","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2019:3292","https://access.redhat.com/errata/RHSA-2019:3297","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/129da0204c876f746636018751a086cc581e0e07bcdeb3ee22ff5731@%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/15a55e1d837fa686db493137cc0330c7ee1089ed9a9eea7ae7151ef1@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/1e04d9381c801b31ab28dec813c31c304b2a596b2a3707fa5462c5c0@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/28be28ffd6471d230943a255c36fe196a54ef5afc494a4781d16e37c@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/2ff264b6a94c5363a35c4c88fa93216f60ec54d1d973ed6b76a9f560@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/4b832d1327703d6b287a6d223307f8f884d798821209a10647e93324@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/71f9ffd92410a889e27b95a219eaa843fd820f8550898633d85d4ea3@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/8fe2983f6d9fee0aa737e4bd24483f8f5cf9b938b9adad0c4e79b2a4@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef@%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/a3ae8a8c5e32c413cd27071d3a204166050bf79ce7f1299f6866338f@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/a62aa2706105d68f1c02023fe24aaa3c13b4d8a1826181fed07d9682@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/a78239b1f11cddfa86e4edee19064c40b6272214630bfef070c37957@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0a2b2cca072650dbd5882719976c3d353972c44f6736ddf0ba95209@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/b148fa2e9ef468c4de00de255dd728b74e2a97d935f8ced31eb41ba2@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/bf20574dbc2db255f1fd489942b5720f675e32a2c4f44eb6a36060cd@%3Ccommits.accumulo.apache.org%3E","https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe@%3Cnotifications.geode.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be@%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/eff7280055fc717ea8129cd28a9dd57b8446d00b36260c1caee10b87@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/5f7c69bba07a7155adde130d9dee2e54a54f1fa5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC","https://security.netapp.com/advisory/ntap-20190625-0006"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cmfg-87vq-g5g4","description":"Deserialization of untrusted data in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-12814","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12814","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12814","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12814","date":"2026-10-10","epss":0.10902,"percentile":0.95781}],"urls":["https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:2935","https://access.redhat.com/errata/RHSA-2019:2936","https://access.redhat.com/errata/RHSA-2019:2937","https://access.redhat.com/errata/RHSA-2019:2938","https://access.redhat.com/errata/RHSA-2019:3044","https://access.redhat.com/errata/RHSA-2019:3045","https://access.redhat.com/errata/RHSA-2019:3046","https://access.redhat.com/errata/RHSA-2019:3050","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2019:3292","https://access.redhat.com/errata/RHSA-2019:3297","https://github.com/FasterXML/jackson-databind/issues/2341","https://lists.apache.org/thread.html/0d4b630d9ee724aee50703397d9d1afa2b2befc9395ba7797d0ccea9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/129da0204c876f746636018751a086cc581e0e07bcdeb3ee22ff5731%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/15a55e1d837fa686db493137cc0330c7ee1089ed9a9eea7ae7151ef1%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/1e04d9381c801b31ab28dec813c31c304b2a596b2a3707fa5462c5c0%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/28be28ffd6471d230943a255c36fe196a54ef5afc494a4781d16e37c%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/2d2a76440becb610b9a9cb49b15eac3934b02c2dbcaacde1000353e4%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/2ff264b6a94c5363a35c4c88fa93216f60ec54d1d973ed6b76a9f560%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/34717424b4d08b74f65c09a083d6dd1cb0763f37a15d6de135998c1d%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/3f99ae8dcdbd69438cb733d745ee3ad5e852068490719a66509b4592%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/4b832d1327703d6b287a6d223307f8f884d798821209a10647e93324%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/56c8042873595b8c863054c7bfccab4bf2c01c6f5abedae249d914b9%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5ecc333113b139429f4f05000d4aa2886974d4df3269c1dd990bb319%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/5fc0e16b7af2590bf1e97c76c136291c4fdb244ee63c65c485c9a7a1%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/71f9ffd92410a889e27b95a219eaa843fd820f8550898633d85d4ea3%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/87e46591de8925f719664a845572d184027258c5a7af0a471b53c77b%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/8fe2983f6d9fee0aa737e4bd24483f8f5cf9b938b9adad0c4e79b2a4%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/940b4c3fef002461b89a050935337056d4a036a65ef68e0bbd4621ef%40%3Cdev.struts.apache.org%3E","https://lists.apache.org/thread.html/a3ae8a8c5e32c413cd27071d3a204166050bf79ce7f1299f6866338f%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/a62aa2706105d68f1c02023fe24aaa3c13b4d8a1826181fed07d9682%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/a78239b1f11cddfa86e4edee19064c40b6272214630bfef070c37957%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0a2b2cca072650dbd5882719976c3d353972c44f6736ddf0ba95209%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/b148fa2e9ef468c4de00de255dd728b74e2a97d935f8ced31eb41ba2%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/bf20574dbc2db255f1fd489942b5720f675e32a2c4f44eb6a36060cd%40%3Ccommits.accumulo.apache.org%3E","https://lists.apache.org/thread.html/e0733058c0366b703e6757d8d2a7a04b943581f659e9c271f0841dfe%40%3Cnotifications.geode.apache.org%3E","https://lists.apache.org/thread.html/ee0a051428d2c719acfa297d0854a189ea5e284ef3ed491fa672f4be%40%3Cdev.tomee.apache.org%3E","https://lists.apache.org/thread.html/eff7280055fc717ea8129cd28a9dd57b8446d00b36260c1caee10b87%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OVRZDN2T6AZ6DJCZJ3VSIQIVHBVMVWBL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXRVXNRFHJSQWFHPRJQRI5UPMZ63B544/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKUALE2TUCKEKOHE2D342PQXN4MWCSLC/","https://security.netapp.com/advisory/ntap-20190625-0006/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12814","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h3cw-g4mq-c5x2","versionConstraint":">=2.0.0,<=2.9.10.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h3cw-g4mq-c5x2","fix":{"state":"fixed","versions":["2.9.10.6"],"available":[{"date":"2021-12-10","kind":"first-observed","version":"2.9.10.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24616","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24616","date":"2026-10-10","epss":0.0758,"percentile":0.94398}],"risk":5.912400000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-24616","https://github.com/FasterXML/jackson-databind/issues/2814","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20200904-0006/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://github.com/FasterXML/jackson-databind/commit/3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h3cw-g4mq-c5x2","description":"Code Injection in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-24616","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24616","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24616","date":"2026-10-10","epss":0.0758,"percentile":0.94398}],"urls":["https://github.com/FasterXML/jackson-databind/issues/2814","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20200904-0006/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-24616","description":"FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP)."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-h3cw-g4mq-c5x2","versionConstraint":">=2.0.0,<=2.9.10.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-h3cw-g4mq-c5x2","fix":{"state":"fixed","versions":["2.9.10.6"],"available":[{"date":"2021-12-10","kind":"first-observed","version":"2.9.10.6"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24616","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24616","date":"2026-10-10","epss":0.0758,"percentile":0.94398}],"risk":5.912400000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-24616","https://github.com/FasterXML/jackson-databind/issues/2814","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20200904-0006/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://github.com/FasterXML/jackson-databind/commit/3d97153944f7de9c19c1b3637b33d3cf1fbbe4d7"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-h3cw-g4mq-c5x2","description":"Code Injection in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-24616","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24616","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24616","date":"2026-10-10","epss":0.0758,"percentile":0.94398}],"urls":["https://github.com/FasterXML/jackson-databind/issues/2814","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20200904-0006/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-24616","description":"FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP)."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5949-rw7g-wx7w","versionConstraint":"<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5949-rw7g-wx7w","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-08-08","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20190","cwe":"CWE-502","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-20190","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-20190","date":"2026-10-10","epss":0.07483,"percentile":0.9434}],"risk":5.83674,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-20190","https://github.com/FasterXML/jackson-databind/issues/2854","https://github.com/FasterXML/jackson-databind/commit/7dbf51bf78d157098074a20bd9da39bd48c18e4a","https://bugzilla.redhat.com/show_bug.cgi?id=1916633","https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a@%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/FasterXML/jackson-databind/commit/08fbfacf89a4a4c026a6227a1b470ab7a13e2e88","https://security.netapp.com/advisory/ntap-20210219-0008"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5949-rw7g-wx7w","description":"Deserialization of untrusted data in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2021-20190","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:C","metrics":{"baseScore":8.3,"impactScore":8.6,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20190","cwe":"CWE-502","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-20190","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-20190","date":"2026-10-10","epss":0.07483,"percentile":0.9434}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1916633","https://github.com/FasterXML/jackson-databind/issues/2854","https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a%40%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210219-0008/","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-20190","description":"A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-5949-rw7g-wx7w","versionConstraint":"<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-5949-rw7g-wx7w","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-08-08","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20190","cwe":"CWE-502","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-20190","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-20190","date":"2026-10-10","epss":0.07483,"percentile":0.9434}],"risk":5.83674,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-20190","https://github.com/FasterXML/jackson-databind/issues/2854","https://github.com/FasterXML/jackson-databind/commit/7dbf51bf78d157098074a20bd9da39bd48c18e4a","https://bugzilla.redhat.com/show_bug.cgi?id=1916633","https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a@%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/FasterXML/jackson-databind/commit/08fbfacf89a4a4c026a6227a1b470ab7a13e2e88","https://security.netapp.com/advisory/ntap-20210219-0008"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-5949-rw7g-wx7w","description":"Deserialization of untrusted data in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2021-20190","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:C","metrics":{"baseScore":8.3,"impactScore":8.6,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-20190","cwe":"CWE-502","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-20190","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-20190","date":"2026-10-10","epss":0.07483,"percentile":0.9434}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1916633","https://github.com/FasterXML/jackson-databind/issues/2854","https://lists.apache.org/thread.html/r380e9257bacb8551ee6fcf2c59890ae9477b2c78e553fa9ea08e9d9a%40%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210219-0008/","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-20190","description":"A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13115","versionConstraint":"< 1.4.3-4.1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13115","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-13115","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13115","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-13115","date":"2026-10-10","epss":0.11659,"percentile":0.95965}],"risk":5.8295,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13115"},"relatedVulnerabilities":[{"id":"CVE-2019-13115","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-13115","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-13115","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-13115","date":"2026-10-10","epss":0.11659,"percentile":0.95965}],"urls":["http://packetstormsecurity.com/files/172834/libssh2-1.8.2-Out-Of-Bounds-Read.html","https://blog.semmle.com/libssh2-integer-overflow/","https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa","https://github.com/libssh2/libssh2/pull/350","https://libssh2.org/changes.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html","https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/","https://security.netapp.com/advisory/ntap-20190806-0002/","https://support.f5.com/csp/article/K13322484","https://support.f5.com/csp/article/K13322484?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13115","description":"In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855."}]},{"artifact":{"id":"bc62643e3de6a29b","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/debian/libssl1.0.0@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openssl","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0737","versionConstraint":"< 1.0.1t-1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0737","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-10","epss":0.11597,"percentile":0.95951}],"risk":5.7985,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0737"},"relatedVulnerabilities":[{"id":"CVE-2018-0737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-10","epss":0.11597,"percentile":0.95951}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103766","http://www.securitytracker.com/id/1040685","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=349a41da1ad88ad87825414752a8ff5fdd6a6c3f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6939eab03a6e23d2bd2c3f5e34fe1d48e542e787","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.netapp.com/advisory/ntap-20180726-0003/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3628-1/","https://usn.ubuntu.com/3628-2/","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180416.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0737","description":"The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o)."}]},{"artifact":{"id":"fe537632576991e6","cpes":["cpe:2.3:a:openssl:openssl:1.0.1t-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/debian/openssl@1.0.1t-1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.1t-1+deb8u2","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1t-1+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0737","versionConstraint":"< 1.0.1t-1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openssl","version":"1.0.1t-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-0737","fix":{"state":"fixed","versions":["1.0.1t-1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.1t-1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-10","epss":0.11597,"percentile":0.95951}],"risk":5.7985,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-0737"},"relatedVulnerabilities":[{"id":"CVE-2018-0737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-10","epss":0.11597,"percentile":0.95951}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103766","http://www.securitytracker.com/id/1040685","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=349a41da1ad88ad87825414752a8ff5fdd6a6c3f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6939eab03a6e23d2bd2c3f5e34fe1d48e542e787","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.netapp.com/advisory/ntap-20180726-0003/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3628-1/","https://usn.ubuntu.com/3628-2/","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180416.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0737","description":"The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o)."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qjw2-hr98-qgfh","versionConstraint":">=2.0,<=2.6.7.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qjw2-hr98-qgfh","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2022-04-09","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24750","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24750","date":"2026-10-10","epss":0.07327,"percentile":0.9425}],"risk":5.71506,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-24750","https://github.com/FasterXML/jackson-databind/issues/2798","https://github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b","https://security.netapp.com/advisory/ntap-20201009-0003/","https://www.oracle.com/security-alerts/cpujan2021.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://github.com/FasterXML/jackson-databind/commit/2118e71325486c68f089a9761c9d8a11b4ddd1cb","https://www.oracle.com/security-alerts/cpuapr2022.html","https://github.com/FasterXML/jackson-databind/commit/6cc9f1a1af323cd156f5668a47e43bab324ae16f"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qjw2-hr98-qgfh","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-24750","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24750","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24750","date":"2026-10-10","epss":0.07327,"percentile":0.9425}],"urls":["https://github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b","https://github.com/FasterXML/jackson-databind/issues/2798","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20201009-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-24750","description":"FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qjw2-hr98-qgfh","versionConstraint":">=2.0,<=2.6.7.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qjw2-hr98-qgfh","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2022-04-09","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24750","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24750","date":"2026-10-10","epss":0.07327,"percentile":0.9425}],"risk":5.71506,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-24750","https://github.com/FasterXML/jackson-databind/issues/2798","https://github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b","https://security.netapp.com/advisory/ntap-20201009-0003/","https://www.oracle.com/security-alerts/cpujan2021.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://github.com/FasterXML/jackson-databind/commit/2118e71325486c68f089a9761c9d8a11b4ddd1cb","https://www.oracle.com/security-alerts/cpuapr2022.html","https://github.com/FasterXML/jackson-databind/commit/6cc9f1a1af323cd156f5668a47e43bab324ae16f"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qjw2-hr98-qgfh","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-24750","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-24750","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-24750","date":"2026-10-10","epss":0.07327,"percentile":0.9425}],"urls":["https://github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b","https://github.com/FasterXML/jackson-databind/issues/2798","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20201009-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-24750","description":"FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration."}]},{"artifact":{"id":"57469482e26b9740","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-10","epss":0.11334,"percentile":0.95891}],"risk":5.667,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543"},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-10","epss":0.11334,"percentile":0.95891}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"71183f78a986047d","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-10","epss":0.11334,"percentile":0.95891}],"risk":5.667,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543"},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-10","epss":0.11334,"percentile":0.95891}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"16a442ba7a1a09d3","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u6?arch=all&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-10","epss":0.11334,"percentile":0.95891}],"risk":5.667,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10543"},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-10","epss":0.11334,"percentile":0.95891}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"2d59f7478c0a2886","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.5&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9841","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9841","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9841","date":"2026-10-10","epss":0.0755,"percentile":0.94379}],"risk":5.6625,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9841"},"relatedVulnerabilities":[{"id":"CVE-2016-9841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9841","date":"2026-10-10","epss":0.0755,"percentile":0.94379}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","http://www.securitytracker.com/id/1039596","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402346","https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://security.netapp.com/advisory/ntap-20171019-0001/","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9841","description":"inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic."}]},{"artifact":{"id":"796f2a2a2aa72b2c","cpes":["cpe:2.3:a:libicu52:libicu52:52.1-8\\+deb8u3:*:*:*:*:*:*:*"],"name":"libicu52","purl":"pkg:deb/debian/libicu52@52.1-8%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=icu","type":"deb","version":"52.1-8+deb8u3","language":"","licenses":["sha256:d1fcfd4dec63109efa1c8e00748a9bf2cb1d1682bb7fc281c9509efc26e3d487"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libicu52/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libicu52/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libicu52:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libicu52:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"icu"}]},"matchDetails":[{"fix":{"suggestedVersion":"52.1-8+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-4844","versionConstraint":"< 52.1-8+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"icu","version":"52.1-8+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-4844","fix":{"state":"fixed","versions":["52.1-8+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"52.1-8+deb8u4"}]},"cvss":[],"epss":[{"cve":"CVE-2015-4844","date":"2026-10-10","epss":0.07514,"percentile":0.94358}],"risk":5.6355,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3725-1","link":"https://security-tracker.debian.org/tracker/DSA-3725-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-4844"},"relatedVulnerabilities":[{"id":"CVE-2015-4844","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-4844","date":"2026-10-10","epss":0.07514,"percentile":0.94358}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00001.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00009.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00001.html","http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html","http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00014.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html","http://rhn.redhat.com/errata/RHSA-2015-1919.html","http://rhn.redhat.com/errata/RHSA-2015-1920.html","http://rhn.redhat.com/errata/RHSA-2015-1921.html","http://rhn.redhat.com/errata/RHSA-2015-1926.html","http://rhn.redhat.com/errata/RHSA-2015-1927.html","http://rhn.redhat.com/errata/RHSA-2015-1928.html","http://rhn.redhat.com/errata/RHSA-2015-2506.html","http://rhn.redhat.com/errata/RHSA-2015-2507.html","http://rhn.redhat.com/errata/RHSA-2015-2508.html","http://rhn.redhat.com/errata/RHSA-2015-2509.html","http://rhn.redhat.com/errata/RHSA-2015-2518.html","http://www.debian.org/security/2015/dsa-3381","http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.securityfocus.com/bid/77164","http://www.securitytracker.com/id/1033884","http://www.ubuntu.com/usn/USN-2784-1","http://www.ubuntu.com/usn/USN-2827-1","https://access.redhat.com/errata/RHSA-2016:1430","https://security.gentoo.org/glsa/201603-11","https://security.gentoo.org/glsa/201603-14"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-4844","description":"Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D."}]},{"artifact":{"id":"d4a4e53150a9623c","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.17.2-1.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.17.2-1.1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=nss","type":"deb","version":"2:3.17.2-1.1+deb8u2","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-7181","versionConstraint":"< 2:3.26-1+debu8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"nss","version":"2:3.17.2-1.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-7181","fix":{"state":"fixed","versions":["2:3.26-1+debu8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-7181","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7181","date":"2026-10-10","epss":0.07507,"percentile":0.94354}],"risk":5.63025,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3688-1","link":"https://security-tracker.debian.org/tracker/DSA-3688-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-7181"},"relatedVulnerabilities":[{"id":"CVE-2015-7181","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-7181","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7181","date":"2026-10-10","epss":0.07507,"percentile":0.94354}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00020.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html","http://lists.opensuse.org/opensuse-updates/2015-12/msg00037.html","http://lists.opensuse.org/opensuse-updates/2015-12/msg00049.html","http://packetstormsecurity.com/files/134268/Slackware-Security-Advisory-mozilla-nss-Updates.html","http://rhn.redhat.com/errata/RHSA-2015-1980.html","http://rhn.redhat.com/errata/RHSA-2015-1981.html","http://www.debian.org/security/2015/dsa-3393","http://www.debian.org/security/2015/dsa-3410","http://www.debian.org/security/2016/dsa-3688","http://www.mozilla.org/security/announce/2015/mfsa2015-133.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","http://www.securityfocus.com/bid/77416","http://www.securityfocus.com/bid/91787","http://www.securitytracker.com/id/1034069","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.399753","http://www.ubuntu.com/usn/USN-2785-1","http://www.ubuntu.com/usn/USN-2791-1","http://www.ubuntu.com/usn/USN-2819-1","https://bto.bluecoat.com/security-advisory/sa119","https://bugzilla.mozilla.org/show_bug.cgi?id=1192028","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.1_release_notes","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.4_release_notes","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes","https://security.gentoo.org/glsa/201512-10","https://security.gentoo.org/glsa/201605-06"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-7181","description":"The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted OCTET STRING data, related to a \"use-after-poison\" issue."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w3f4-3q6j-rh82","versionConstraint":"<2.7.9.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w3f4-3q6j-rh82","fix":{"state":"fixed","versions":["2.7.9.5"],"available":[{"date":"2024-03-02","kind":"first-observed","version":"2.7.9.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5968","cwe":"CWE-184","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-5968","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5968","date":"2026-10-10","epss":0.07213,"percentile":0.94176}],"risk":5.62614,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-5968","https://github.com/FasterXML/jackson-databind/issues/1899","https://github.com/GulajavaMinistudio/jackson-databind/pull/92/commits/038b471e2efde2e8f96b4e0be958d3e5a1ff1d05","https://access.redhat.com/errata/RHSA-2018:0478","https://access.redhat.com/errata/RHSA-2018:0479","https://access.redhat.com/errata/RHSA-2018:0480","https://access.redhat.com/errata/RHSA-2018:0481","https://access.redhat.com/errata/RHSA-2018:1525","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2018/dsa-4114","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/038b471e2efde2e8f96b4e0be958d3e5a1ff1d0","https://github.com/FasterXML/jackson-databind/commit/03ea0bec6293d4330b5ad19d1d62aca0e3cb6381","https://github.com/FasterXML/jackson-databind/commit/454be8bb8c913be18298327a84ca45a280b61605","https://security.netapp.com/advisory/ntap-20180423-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w3f4-3q6j-rh82","description":"Deserialization of Untrusted Data in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2018-5968","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5968","cwe":"CWE-184","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-5968","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5968","date":"2026-10-10","epss":0.07213,"percentile":0.94176}],"urls":["https://access.redhat.com/errata/RHSA-2018:0478","https://access.redhat.com/errata/RHSA-2018:0479","https://access.redhat.com/errata/RHSA-2018:0480","https://access.redhat.com/errata/RHSA-2018:0481","https://access.redhat.com/errata/RHSA-2018:1525","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://github.com/FasterXML/jackson-databind/issues/1899","https://security.netapp.com/advisory/ntap-20180423-0002/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2018/dsa-4114","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5968","description":"FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-w3f4-3q6j-rh82","versionConstraint":"<2.7.9.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-w3f4-3q6j-rh82","fix":{"state":"fixed","versions":["2.7.9.5"],"available":[{"date":"2024-03-02","kind":"first-observed","version":"2.7.9.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5968","cwe":"CWE-184","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-5968","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5968","date":"2026-10-10","epss":0.07213,"percentile":0.94176}],"risk":5.62614,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-5968","https://github.com/FasterXML/jackson-databind/issues/1899","https://github.com/GulajavaMinistudio/jackson-databind/pull/92/commits/038b471e2efde2e8f96b4e0be958d3e5a1ff1d05","https://access.redhat.com/errata/RHSA-2018:0478","https://access.redhat.com/errata/RHSA-2018:0479","https://access.redhat.com/errata/RHSA-2018:0480","https://access.redhat.com/errata/RHSA-2018:0481","https://access.redhat.com/errata/RHSA-2018:1525","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2018/dsa-4114","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/038b471e2efde2e8f96b4e0be958d3e5a1ff1d0","https://github.com/FasterXML/jackson-databind/commit/03ea0bec6293d4330b5ad19d1d62aca0e3cb6381","https://github.com/FasterXML/jackson-databind/commit/454be8bb8c913be18298327a84ca45a280b61605","https://security.netapp.com/advisory/ntap-20180423-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w3f4-3q6j-rh82","description":"Deserialization of Untrusted Data in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2018-5968","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5968","cwe":"CWE-184","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-5968","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5968","date":"2026-10-10","epss":0.07213,"percentile":0.94176}],"urls":["https://access.redhat.com/errata/RHSA-2018:0478","https://access.redhat.com/errata/RHSA-2018:0479","https://access.redhat.com/errata/RHSA-2018:0480","https://access.redhat.com/errata/RHSA-2018:0481","https://access.redhat.com/errata/RHSA-2018:1525","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://github.com/FasterXML/jackson-databind/issues/1899","https://security.netapp.com/advisory/ntap-20180423-0002/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us","https://www.debian.org/security/2018/dsa-4114","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5968","description":"FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist."}]},{"artifact":{"id":"796f2a2a2aa72b2c","cpes":["cpe:2.3:a:libicu52:libicu52:52.1-8\\+deb8u3:*:*:*:*:*:*:*"],"name":"libicu52","purl":"pkg:deb/debian/libicu52@52.1-8%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=icu","type":"deb","version":"52.1-8+deb8u3","language":"","licenses":["sha256:d1fcfd4dec63109efa1c8e00748a9bf2cb1d1682bb7fc281c9509efc26e3d487"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libicu52/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libicu52/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libicu52:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libicu52:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"icu"}]},"matchDetails":[{"fix":{"suggestedVersion":"52.1-8+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-0494","versionConstraint":"< 52.1-8+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"icu","version":"52.1-8+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-0494","fix":{"state":"fixed","versions":["52.1-8+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"52.1-8+deb8u4"}]},"cvss":[],"epss":[{"cve":"CVE-2016-0494","date":"2026-10-10","epss":0.07211,"percentile":0.94174}],"risk":5.408249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3725-1","link":"https://security-tracker.debian.org/tracker/DSA-3725-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-0494"},"relatedVulnerabilities":[{"id":"CVE-2016-0494","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-0494","date":"2026-10-10","epss":0.07211,"percentile":0.94174}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html","http://rhn.redhat.com/errata/RHSA-2016-0049.html","http://rhn.redhat.com/errata/RHSA-2016-0050.html","http://rhn.redhat.com/errata/RHSA-2016-0053.html","http://rhn.redhat.com/errata/RHSA-2016-0054.html","http://rhn.redhat.com/errata/RHSA-2016-0055.html","http://rhn.redhat.com/errata/RHSA-2016-0056.html","http://rhn.redhat.com/errata/RHSA-2016-0057.html","http://rhn.redhat.com/errata/RHSA-2016-0067.html","http://www.debian.org/security/2016/dsa-3458","http://www.debian.org/security/2016/dsa-3465","http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html","http://www.securitytracker.com/id/1034715","http://www.ubuntu.com/usn/USN-2884-1","http://www.ubuntu.com/usn/USN-2885-1","https://access.redhat.com/errata/RHSA-2016:1430","https://security.gentoo.org/glsa/201603-14","https://security.gentoo.org/glsa/201610-08"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-0494","description":"Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66 and Java SE Embedded 8u65 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qr7j-h6gg-jmgc","versionConstraint":">=2.0.0,<=2.7.9.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qr7j-h6gg-jmgc","fix":{"state":"fixed","versions":["2.7.9.4"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"2.7.9.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11307","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11307","date":"2026-10-10","epss":0.0573,"percentile":0.92867}],"risk":5.3862,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-11307","https://access.redhat.com/errata/RHSA-2019:0782","https://github.com/FasterXML/jackson-databind/issues/2032","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://nvd.nist.gov/vuln/detail/CVE-2017-7525","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://github.com/FasterXML/jackson-databind/commit/051bd5e447fbc9539e12a4fe90eb989dba0c656","https://github.com/FasterXML/jackson-databind/commit/27b4defc270454dea6842bd9279f17387eceb73","https://github.com/FasterXML/jackson-databind/commit/78e78738d69adcb59fdac9fc12d9053ce8809f3d"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qr7j-h6gg-jmgc","description":"Deserialization of Untrusted Data in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2018-11307","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11307","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11307","date":"2026-10-10","epss":0.0573,"percentile":0.92867}],"urls":["https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson-databind/issues/2032","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://nvd.nist.gov/vuln/detail/CVE-2017-7525","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11307","description":"An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-qr7j-h6gg-jmgc","versionConstraint":">=2.0.0,<=2.7.9.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-qr7j-h6gg-jmgc","fix":{"state":"fixed","versions":["2.7.9.4"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"2.7.9.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11307","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11307","date":"2026-10-10","epss":0.0573,"percentile":0.92867}],"risk":5.3862,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-11307","https://access.redhat.com/errata/RHSA-2019:0782","https://github.com/FasterXML/jackson-databind/issues/2032","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://nvd.nist.gov/vuln/detail/CVE-2017-7525","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://github.com/FasterXML/jackson-databind/commit/051bd5e447fbc9539e12a4fe90eb989dba0c656","https://github.com/FasterXML/jackson-databind/commit/27b4defc270454dea6842bd9279f17387eceb73","https://github.com/FasterXML/jackson-databind/commit/78e78738d69adcb59fdac9fc12d9053ce8809f3d"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-qr7j-h6gg-jmgc","description":"Deserialization of Untrusted Data in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2018-11307","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11307","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11307","date":"2026-10-10","epss":0.0573,"percentile":0.92867}],"urls":["https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://github.com/FasterXML/jackson-databind/issues/2032","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://nvd.nist.gov/vuln/detail/CVE-2017-7525","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11307","description":"An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mx7p-6679-8g3q","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mx7p-6679-8g3q","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2024-03-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16942","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16942","date":"2026-10-10","epss":0.05728,"percentile":0.92863}],"risk":5.38432,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-16942","https://github.com/FasterXML/jackson-databind/issues/2478","https://issues.apache.org/jira/browse/GEODE-7255","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/7782a937c9259a58337ee36b2961f00e2d744feafc13084e176d0df5@%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/a430dbc9be874c41314cc69e697384567a9a24025e819d9485547954@%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b2e23c94f9dfef53e04c492e5d02e5c75201734be7adc73a49ef2370@%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://seclists.org/bugtraq/2019/Oct/6","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/FasterXML/jackson-databind/commit/328a0f833daf6baa443ac3b37c818a0204714b0b","https://github.com/FasterXML/jackson-databind/commit/54aa38d87dcffa5ccc23e64922e9536c82c1b9c8","https://github.com/FasterXML/jackson-databind/commit/9593e16cf5a3d289a9c584f7123639655de9ddac","https://github.com/FasterXML/jackson-databind/commit/bc67eb11a7cf57561f861ff16f879f1fceb5779f","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT","https://security.netapp.com/advisory/ntap-20191017-0006"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mx7p-6679-8g3q","description":"Polymorphic Typing in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-16942","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16942","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16942","date":"2026-10-10","epss":0.05728,"percentile":0.92863}],"urls":["https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://github.com/FasterXML/jackson-databind/issues/2478","https://issues.apache.org/jira/browse/GEODE-7255","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/7782a937c9259a58337ee36b2961f00e2d744feafc13084e176d0df5%40%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/a430dbc9be874c41314cc69e697384567a9a24025e819d9485547954%40%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b2e23c94f9dfef53e04c492e5d02e5c75201734be7adc73a49ef2370%40%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20191017-0006/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16942","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mx7p-6679-8g3q","versionConstraint":">=2.0.0,<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mx7p-6679-8g3q","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2024-03-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16942","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16942","date":"2026-10-10","epss":0.05728,"percentile":0.92863}],"risk":5.38432,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-16942","https://github.com/FasterXML/jackson-databind/issues/2478","https://issues.apache.org/jira/browse/GEODE-7255","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/7782a937c9259a58337ee36b2961f00e2d744feafc13084e176d0df5@%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/a430dbc9be874c41314cc69e697384567a9a24025e819d9485547954@%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b2e23c94f9dfef53e04c492e5d02e5c75201734be7adc73a49ef2370@%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://seclists.org/bugtraq/2019/Oct/6","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/FasterXML/jackson-databind/commit/328a0f833daf6baa443ac3b37c818a0204714b0b","https://github.com/FasterXML/jackson-databind/commit/54aa38d87dcffa5ccc23e64922e9536c82c1b9c8","https://github.com/FasterXML/jackson-databind/commit/9593e16cf5a3d289a9c584f7123639655de9ddac","https://github.com/FasterXML/jackson-databind/commit/bc67eb11a7cf57561f861ff16f879f1fceb5779f","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT","https://security.netapp.com/advisory/ntap-20191017-0006"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mx7p-6679-8g3q","description":"Polymorphic Typing in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-16942","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16942","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16942","date":"2026-10-10","epss":0.05728,"percentile":0.92863}],"urls":["https://access.redhat.com/errata/RHSA-2019:3901","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://github.com/FasterXML/jackson-databind/issues/2478","https://issues.apache.org/jira/browse/GEODE-7255","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/7782a937c9259a58337ee36b2961f00e2d744feafc13084e176d0df5%40%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/a430dbc9be874c41314cc69e697384567a9a24025e819d9485547954%40%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b2e23c94f9dfef53e04c492e5d02e5c75201734be7adc73a49ef2370%40%3Cissues.geode.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20191017-0006/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16942","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cjjf-94ff-43w7","versionConstraint":"<=2.7.9.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cjjf-94ff-43w7","fix":{"state":"fixed","versions":["2.7.9.4"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"2.7.9.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12022","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12022","date":"2026-10-10","epss":0.07152,"percentile":0.94134}],"risk":5.364,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-12022","https://github.com/FasterXML/jackson-databind/issues/2052","https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1106","https://access.redhat.com/errata/RHSA-2019:1107","https://access.redhat.com/errata/RHSA-2019:1108","https://access.redhat.com/errata/RHSA-2019:1140","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://bugzilla.redhat.com/show_bug.cgi?id=1671098","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://seclists.org/bugtraq/2019/May/68","https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://www.securityfocus.com/bid/107585","https://github.com/FasterXML/jackson-databind/commit/bf261d404c2f79fd3406237710d40ebb03c99d84","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC","https://security.netapp.com/advisory/ntap-20190530-0003","https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cjjf-94ff-43w7","description":"jackson-databind Deserialization of Untrusted Data vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2018-12022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12022","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12022","date":"2026-10-10","epss":0.07152,"percentile":0.94134}],"urls":["http://www.securityfocus.com/bid/107585","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1106","https://access.redhat.com/errata/RHSA-2019:1107","https://access.redhat.com/errata/RHSA-2019:1108","https://access.redhat.com/errata/RHSA-2019:1140","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://bugzilla.redhat.com/show_bug.cgi?id=1671098","https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a","https://github.com/FasterXML/jackson-databind/issues/2052","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC/","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12022","description":"An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7.9.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cjjf-94ff-43w7","versionConstraint":"<=2.7.9.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cjjf-94ff-43w7","fix":{"state":"fixed","versions":["2.7.9.4"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"2.7.9.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12022","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12022","date":"2026-10-10","epss":0.07152,"percentile":0.94134}],"risk":5.364,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-12022","https://github.com/FasterXML/jackson-databind/issues/2052","https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1106","https://access.redhat.com/errata/RHSA-2019:1107","https://access.redhat.com/errata/RHSA-2019:1108","https://access.redhat.com/errata/RHSA-2019:1140","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://bugzilla.redhat.com/show_bug.cgi?id=1671098","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://seclists.org/bugtraq/2019/May/68","https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://www.securityfocus.com/bid/107585","https://github.com/FasterXML/jackson-databind/commit/bf261d404c2f79fd3406237710d40ebb03c99d84","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC","https://security.netapp.com/advisory/ntap-20190530-0003","https://github.com/FasterXML/jackson-databind/commit/7487cf7eb14be2f65a1eb108e8629c07ef45e0a"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cjjf-94ff-43w7","description":"jackson-databind Deserialization of Untrusted Data vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2018-12022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12022","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12022","date":"2026-10-10","epss":0.07152,"percentile":0.94134}],"urls":["http://www.securityfocus.com/bid/107585","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0782","https://access.redhat.com/errata/RHSA-2019:0877","https://access.redhat.com/errata/RHSA-2019:1106","https://access.redhat.com/errata/RHSA-2019:1107","https://access.redhat.com/errata/RHSA-2019:1108","https://access.redhat.com/errata/RHSA-2019:1140","https://access.redhat.com/errata/RHSA-2019:1782","https://access.redhat.com/errata/RHSA-2019:1797","https://access.redhat.com/errata/RHSA-2019:1822","https://access.redhat.com/errata/RHSA-2019:1823","https://access.redhat.com/errata/RHSA-2019:2804","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3002","https://access.redhat.com/errata/RHSA-2019:3140","https://access.redhat.com/errata/RHSA-2019:3149","https://access.redhat.com/errata/RHSA-2019:3892","https://access.redhat.com/errata/RHSA-2019:4037","https://bugzilla.redhat.com/show_bug.cgi?id=1671098","https://github.com/FasterXML/jackson-databind/commit/28badf7ef60ac3e7ef151cd8e8ec010b8479226a","https://github.com/FasterXML/jackson-databind/issues/2052","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/7fcf88aff0d1deaa5c3c7be8d58c05ad7ad5da94b59065d8e7c50c5d%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEDLDUYBSTDY4GWDBUXGJNS2RFYTFVRC/","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://seclists.org/bugtraq/2019/May/68","https://security.netapp.com/advisory/ntap-20190530-0003/","https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf","https://www.debian.org/security/2019/dsa-4452","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12022","description":"An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload."}]},{"artifact":{"id":"5edbbe9f0eaac947","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-6\\+deb8u3:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.1.0-6%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=expat","type":"deb","version":"2.1.0-6+deb8u3","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0-6+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20843","versionConstraint":"< 2.1.0-6+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"expat","version":"2.1.0-6+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-20843","fix":{"state":"fixed","versions":["2.1.0-6+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.0-6+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-20843","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-20843","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-20843","date":"2026-10-10","epss":0.07107,"percentile":0.94097}],"risk":5.3302499999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20843"},"relatedVulnerabilities":[{"id":"CVE-2018-20843","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20843","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-20843","cwe":"CWE-611","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-20843","date":"2026-10-10","epss":0.07107,"percentile":0.94097}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00039.html","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5226","https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes","https://github.com/libexpat/libexpat/issues/186","https://github.com/libexpat/libexpat/pull/262","https://github.com/libexpat/libexpat/pull/262/commits/11f8838bf99ea0a6f0b76f9760c43704d00c4ff6","https://lists.debian.org/debian-lts-announce/2019/06/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEJJSQSG3KSUQY4FPVHZ7ZTT7FORMFVD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IDAUGEB3TUP6NEKJDBUBZX7N5OAUOOOK/","https://seclists.org/bugtraq/2019/Jun/39","https://security.gentoo.org/glsa/201911-08","https://security.netapp.com/advisory/ntap-20190703-0001/","https://support.f5.com/csp/article/K51011533","https://usn.ubuntu.com/4040-1/","https://usn.ubuntu.com/4040-2/","https://www.debian.org/security/2019/dsa-4472","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-11"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20843","description":"In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks)."}]},{"artifact":{"id":"086860a1c675b6eb","cpes":["cpe:2.3:a:libgnutls-deb0-28:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0-28:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*"],"name":"libgnutls-deb0-28","purl":"pkg:deb/debian/libgnutls-deb0-28@3.3.8-6%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=gnutls28","type":"deb","version":"3.3.8-6+deb8u3","language":"","licenses":["sha256:cffad6d97811bc8c8755b86819dbece70c2da355bf2d50a24bdc0e85a6cc2fef"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-deb0-28/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libgnutls-deb0-28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.3.8-6+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5336","versionConstraint":"< 3.3.8-6+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"gnutls28","version":"3.3.8-6+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-5336","fix":{"state":"fixed","versions":["3.3.8-6+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.3.8-6+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5336","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5336","date":"2026-10-10","epss":0.07071,"percentile":0.94069}],"risk":5.303249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-5336"},"relatedVulnerabilities":[{"id":"CVE-2017-5336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5336","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5336","date":"2026-10-10","epss":0.07071,"percentile":0.94069}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://www.openwall.com/lists/oss-security/2017/01/10/7","http://www.openwall.com/lists/oss-security/2017/01/11/4","http://www.securityfocus.com/bid/95377","http://www.securitytracker.com/id/1037576","https://access.redhat.com/errata/RHSA-2017:2292","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=340","https://gitlab.com/gnutls/gnutls/commit/5140422e0d7319a8e2fe07f02cbcafc4d6538732","https://gnutls.org/security.html#GNUTLS-SA-2017-2","https://security.gentoo.org/glsa/201702-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5336","description":"Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate."}]},{"artifact":{"id":"313fa3578fbafcd9","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u2:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"2.9.1+dfsg1-5+deb8u2","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-4448","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-4448","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-4448","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4448","date":"2026-10-10","epss":0.07039,"percentile":0.94042}],"risk":5.279249999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-4448"},"relatedVulnerabilities":[{"id":"CVE-2016-4448","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4448","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4448","date":"2026-10-10","epss":0.07039,"percentile":0.94042}],"urls":["http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00002.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html","http://lists.apple.com/archives/security-announce/2016/Jul/msg00005.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.openwall.com/lists/oss-security/2016/05/25/2","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html","http://www.securityfocus.com/bid/90856","http://www.securitytracker.com/id/1036348","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.404722","http://xmlsoft.org/news.html","https://access.redhat.com/errata/RHSA-2016:1292","https://bugzilla.redhat.com/show_bug.cgi?id=1338700","https://git.gnome.org/browse/libxml2/commit/?id=4472c3a5a5b516aaf59b89be602fbce52756c3e9","https://git.gnome.org/browse/libxml2/commit/?id=502f6a6d08b08c04b3ddfb1cd21b2f699c1b7f5b","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05194709","https://kc.mcafee.com/corporate/index?page=content&id=SB10170","https://support.apple.com/HT206899","https://support.apple.com/HT206901","https://support.apple.com/HT206902","https://support.apple.com/HT206903","https://support.apple.com/HT206904","https://support.apple.com/HT206905","https://www.tenable.com/security/tns-2016-18"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4448","description":"Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors."}]},{"artifact":{"id":"260f55a1bd116a7f","cpes":["cpe:2.3:a:apache:commons-io:2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_io:2.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.1:*:*:*:*:*:*:*"],"name":"commons-io","purl":"pkg:maven/commons-io/commons-io@2.1","type":"java-archive","version":"2.1","language":"java","licenses":[],"metadata":{"pomGroupID":"commons-io","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-rest-module-2.9.24.jar:commons-io:commons-io","manifestName":"","pomArtifactID":"commons-io","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-rest-module-2.9.24.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwrp-pvrq-jmwv","versionConstraint":"<2.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-io:commons-io","version":"2.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gwrp-pvrq-jmwv","fix":{"state":"fixed","versions":["2.7"],"available":[{"date":"2021-04-27","kind":"first-observed","version":"2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-29425","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-29425","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-29425","date":"2026-10-10","epss":0.10549,"percentile":0.95675}],"risk":5.16901,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-29425","https://issues.apache.org/jira/browse/IO-556","https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31@%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330@%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34@%3Cdev.myfaces.apache.org%3E","https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa@%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a@%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e@%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d@%3Cdev.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html","https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b@%3Cissues.zookeeper.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://arxiv.org/pdf/2306.05534.pdf","https://github.com/jensdietrich/xshady-release/tree/main/CVE-2021-29425","https://security.netapp.com/advisory/ntap-20220210-0004"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwrp-pvrq-jmwv","description":"Path Traversal and Improper Input Validation in Apache Commons IO"},"relatedVulnerabilities":[{"id":"CVE-2021-29425","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-29425","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-29425","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-29425","date":"2026-10-10","epss":0.10549,"percentile":0.95675}],"urls":["https://issues.apache.org/jira/browse/IO-556","https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34%40%3Cdev.myfaces.apache.org%3E","https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e%40%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330%40%3Cdev.commons.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html","https://security.netapp.com/advisory/ntap-20220210-0004/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-29425","description":"In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like \"//../foo\", or \"\\\\..\\foo\", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus \"limited\" path traversal), if the calling code would use the result to construct a path value."}]},{"artifact":{"id":"1b7efb710a253d26","cpes":["cpe:2.3:a:apache:commons-io:2.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_io:2.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:2.4:*:*:*:*:*:*:*","cpe:2.3:a:apache:io:2.4:*:*:*:*:*:*:*"],"name":"commons-io","purl":"pkg:maven/commons-io/commons-io@2.4","type":"java-archive","version":"2.4","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"commons-io","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-io-2.4.jar","manifestName":"","pomArtifactID":"commons-io","archiveDigests":[{"value":"b1b6ea3b7e4aa4f492509a4952029cd8e48019ad","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-io-2.4.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-io-2.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gwrp-pvrq-jmwv","versionConstraint":"<2.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-io:commons-io","version":"2.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gwrp-pvrq-jmwv","fix":{"state":"fixed","versions":["2.7"],"available":[{"date":"2021-04-27","kind":"first-observed","version":"2.7"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-29425","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-29425","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-29425","date":"2026-10-10","epss":0.10549,"percentile":0.95675}],"risk":5.16901,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-29425","https://issues.apache.org/jira/browse/IO-556","https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31@%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330@%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34@%3Cdev.myfaces.apache.org%3E","https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa@%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a@%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e@%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29@%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d@%3Cdev.zookeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html","https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2@%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046@%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b@%3Cissues.zookeeper.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://arxiv.org/pdf/2306.05534.pdf","https://github.com/jensdietrich/xshady-release/tree/main/CVE-2021-29425","https://security.netapp.com/advisory/ntap-20220210-0004"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gwrp-pvrq-jmwv","description":"Path Traversal and Improper Input Validation in Apache Commons IO"},"relatedVulnerabilities":[{"id":"CVE-2021-29425","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-29425","cwe":"CWE-20","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-29425","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-29425","date":"2026-10-10","epss":0.10549,"percentile":0.95675}],"urls":["https://issues.apache.org/jira/browse/IO-556","https://lists.apache.org/thread.html/r01b4a1fcdf3311c936ce33d75a9398b6c255f00c1a2f312ac21effe1%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r0bfa8f7921abdfae788b1f076a12f73a92c93cc0a6e1083bce0027c5%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r0d73e2071d1f1afe1a15da14c5b6feb2cf17e3871168d5a3c8451436%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r1c2f4683c35696cf6f863e3c107e37ec41305b1930dd40c17260de71%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r20416f39ca7f7344e7d76fe4d7063bb1d91ad106926626e7e83fb346%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2345b49dbffa8a5c3c589c082fe39228a2c1d14f11b96c523da701db%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/r27b1eedda37468256c4bb768fde1e8b79b37ec975cbbfd0d65a7ac34%40%3Cdev.myfaces.apache.org%3E","https://lists.apache.org/thread.html/r2bc986a070457daca457a54fe71ee09d2584c24dc262336ca32b6a19%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2df50af2641d38f432ef025cd2ba5858215cc0cf3fc10396a674ad2e%40%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/r345330b7858304938b7b8029d02537a116d75265a598c98fa333504a%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4050f9f6b42ebfa47a98cbdee4aabed4bb5fb8093db7dbb88faceba2%40%3Ccommits.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r462db908acc1e37c455e11b1a25992b81efd18e641e7e0ceb1b6e046%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r477c285126ada5c3b47946bb702cb222ac4e7fd3100c8549bdd6d3b2%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r47ab6f68cbba8e730f42c4ea752f3a44eb95fb09064070f2476bb401%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r5149f78be265be69d34eacb4e4b0fc7c9c697bcdfa91a1c1658d717b%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r523a6ffad58f71c4f3761e3cee72df878e48cdc89ebdce933be1475c%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r808be7d93b17a7055c1981a8453ae5f0d0fce5855407793c5d0ffffa%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/r8569a41d565ca880a4dee0e645dad1cd17ab4a92e68055ad9ebb7375%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r86528f4b7d222aed7891e7ac03d69a0db2a2dfa17b86ac3470d7f374%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r873d5ddafc0a68fd999725e559776dc4971d1ab39c0f5cc81bd9bc04%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r8bfc7235e6b39d90e6f446325a5a44c3e9e50da18860fdabcee23e29%40%3Cissues.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/r8efcbabde973ea72f5e0933adc48ef1425db5cde850bf641b3993f31%40%3Cdev.commons.apache.org%3E","https://lists.apache.org/thread.html/r92ea904f4bae190b03bd42a4355ce3c2fbe8f36ab673e03f6ca3f9fa%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/ra8ef65aedc086d2d3d21492b4c08ae0eb8a3a42cc52e29ba1bc009d8%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/raa053846cae9d497606027816ae87b4e002b2e0eb66cb0dee710e1f5%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rad4ae544747df32ccd58fff5a86cd556640396aeb161aa71dd3d192a%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rbebd3e19651baa7a4a5503a9901c95989df9d40602c8e35cb05d3eb5%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rc10fa20ef4d13cbf6ebe0b06b5edb95466a1424a9b7673074ed03260%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc2dd3204260e9227a67253ef68b6f1599446005bfa0e1ddce4573a80%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rc359823b5500e9a9a2572678ddb8e01d3505a7ffcadfa8d13b8780ab%40%3Cuser.commons.apache.org%3E","https://lists.apache.org/thread.html/rc5f3df5316c5237b78a3dff5ab95b311ad08e61d418cd992ca7e34ae%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rc65f9bc679feffe4589ea0981ee98bc0af9139470f077a91580eeee0%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/rca71a10ca533eb9bfac2d590533f02e6fb9064d3b6aa3ec90fdc4f51%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rd09d4ab3e32e4b3a480e2ff6ff118712981ca82e817f28f2a85652a6%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/re41e9967bee064e7369411c28f0f5b2ad28b8334907c9c6208017279%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/red3aea910403d8620c73e1c7b9c9b145798d0469eb3298a7be7891af%40%3Cnotifications.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rfa2f08b7c0caf80ca9f4a18bd875918fdd4e894e2ea47942a4589b9c%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfcd2c649c205f12b72dde044f905903460669a220a2eb7e12652d19d%40%3Cdev.zookeeper.apache.org%3E","https://lists.apache.org/thread.html/rfd01af05babc95b8949e6d8ea78d9834699e1b06981040dde419a330%40%3Cdev.commons.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00016.html","https://security.netapp.com/advisory/ntap-20220210-0004/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-29425","description":"In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like \"//../foo\", or \"\\\\..\\foo\", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus \"limited\" path traversal), if the calling code would use the result to construct a path value."}]},{"artifact":{"id":"db8ea562e46a3772","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20346","versionConstraint":"< 3.8.7.1-1+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-20346","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-20346","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20346","date":"2026-10-10","epss":0.10312,"percentile":0.95603}],"risk":5.156000000000001,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20346"},"relatedVulnerabilities":[{"id":"CVE-2018-20346","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20346","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20346","date":"2026-10-10","epss":0.10312,"percentile":0.95603}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html","http://www.securityfocus.com/bid/106323","https://access.redhat.com/articles/3758321","https://blade.tencent.com/magellan/index_en.html","https://bugzilla.redhat.com/show_bug.cgi?id=1659379","https://bugzilla.redhat.com/show_bug.cgi?id=1659677","https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html","https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e","https://crbug.com/900910","https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/","https://news.ycombinator.com/item?id=18685296","https://security.gentoo.org/glsa/201904-21","https://sqlite.org/src/info/940f2adc8541a838","https://sqlite.org/src/info/d44318f59044162e","https://support.apple.com/HT209443","https://support.apple.com/HT209446","https://support.apple.com/HT209447","https://support.apple.com/HT209448","https://support.apple.com/HT209450","https://support.apple.com/HT209451","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://worthdoingbadly.com/sqlitebug/","https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc","https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.sqlite.org/releaselog/3_25_3.html","https://www.synology.com/security/advisory/Synology_SA_18_61"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20346","description":"SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gjmw-vf9h-g25v","versionConstraint":"<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gjmw-vf9h-g25v","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17531","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17531","date":"2026-10-10","epss":0.05373,"percentile":0.92465}],"risk":5.05062,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-17531","https://github.com/FasterXML/jackson-databind/issues/2498","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://access.redhat.com/errata/RHSA-2019:4192","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://lists.apache.org/thread.html/b3c90d38f99db546de60fea65f99a924d540fae2285f014b79606ca5@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html","https://security.netapp.com/advisory/ntap-20191024-0005/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/FasterXML/jackson-databind/commit/b5a304a98590b6bb766134f9261e6566dcbbb6d0"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gjmw-vf9h-g25v","description":"jackson-databind polymorphic typing issue"},"relatedVulnerabilities":[{"id":"CVE-2019-17531","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17531","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17531","date":"2026-10-10","epss":0.05373,"percentile":0.92465}],"urls":["https://access.redhat.com/errata/RHSA-2019:4192","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://github.com/FasterXML/jackson-databind/issues/2498","https://lists.apache.org/thread.html/b3c90d38f99db546de60fea65f99a924d540fae2285f014b79606ca5%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20191024-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17531","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gjmw-vf9h-g25v","versionConstraint":"<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gjmw-vf9h-g25v","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17531","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17531","date":"2026-10-10","epss":0.05373,"percentile":0.92465}],"risk":5.05062,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-17531","https://github.com/FasterXML/jackson-databind/issues/2498","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://access.redhat.com/errata/RHSA-2019:4192","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://lists.apache.org/thread.html/b3c90d38f99db546de60fea65f99a924d540fae2285f014b79606ca5@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html","https://security.netapp.com/advisory/ntap-20191024-0005/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/FasterXML/jackson-databind/commit/b5a304a98590b6bb766134f9261e6566dcbbb6d0"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gjmw-vf9h-g25v","description":"jackson-databind polymorphic typing issue"},"relatedVulnerabilities":[{"id":"CVE-2019-17531","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17531","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17531","date":"2026-10-10","epss":0.05373,"percentile":0.92465}],"urls":["https://access.redhat.com/errata/RHSA-2019:4192","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://github.com/FasterXML/jackson-databind/issues/2498","https://lists.apache.org/thread.html/b3c90d38f99db546de60fea65f99a924d540fae2285f014b79606ca5%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20191024-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17531","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload."}]},{"artifact":{"id":"a71914f6177ae515","cpes":["cpe:2.3:a:org.jsoup:jsoup:1.7.2:*:*:*:*:*:*:*","cpe:2.3:a:jsoup:jsoup:1.7.2:*:*:*:*:*:*:*"],"name":"jsoup","purl":"pkg:maven/org.jsoup/jsoup@1.7.2","type":"java-archive","version":"1.7.2","language":"java","licenses":["http://jsoup.com/license"],"metadata":{"pomGroupID":"org.jsoup","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/jsoup-1.7.2.jar","manifestName":"","pomArtifactID":"jsoup","archiveDigests":[{"value":"d7e275ba05aa380ca254f72d0c0ffebaedc3adcf","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/jsoup-1.7.2.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/jsoup-1.7.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.14.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-m72m-mhq2-9p6c","versionConstraint":"<1.14.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.jsoup:jsoup","version":"1.7.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-m72m-mhq2-9p6c","fix":{"state":"fixed","versions":["1.14.2"],"available":[{"date":"2021-08-24","kind":"first-observed","version":"1.14.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-37714","cwe":"CWE-248","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-37714","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-37714","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-37714","date":"2026-10-10","epss":0.06689,"percentile":0.9375}],"risk":5.01675,"urls":["https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c","https://nvd.nist.gov/vuln/detail/CVE-2021-37714","https://jsoup.org/news/release-1.14.1","https://jsoup.org/news/release-1.14.2","https://lists.apache.org/thread.html/r685c5235235ad0c26e86d0ee987fb802c9675de6081dbf0516464e0b@%3Cnotifications.james.apache.org%3E","https://lists.apache.org/thread.html/r97404676a5cf591988faedb887d64e278f522adcaa823d89ca69defe@%3Cnotifications.james.apache.org%3E","https://lists.apache.org/thread.html/rc3354080fc67fb50b45b3c2d12dc4ca2a3c1c78dad3d3ba012c038aa@%3Cnotifications.james.apache.org%3E","https://lists.apache.org/thread.html/r50e9c9466c592ca9d707a5dea549524d19e3287da08d8392f643960e@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r215009dbf7467a9f6506d0c0024cb36cad30071010e62c9352cfaaf0@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r377b93d79817ce649e9e68b3456e6f499747ef1643fa987b342e082e@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r3d71f18adb78e50f626dde689161ca63d3b7491bd9718fcddfaecba7@%3Cissues.maven.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2022.html","https://security.netapp.com/advisory/ntap-20220210-0022/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-m72m-mhq2-9p6c","description":"Uncaught Exception in jsoup"},"relatedVulnerabilities":[{"id":"CVE-2021-37714","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-37714","cwe":"CWE-248","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-37714","cwe":"CWE-835","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2021-37714","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-37714","date":"2026-10-10","epss":0.06689,"percentile":0.9375}],"urls":["https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c","https://jsoup.org/news/release-1.14.1","https://jsoup.org/news/release-1.14.2","https://lists.apache.org/thread.html/r215009dbf7467a9f6506d0c0024cb36cad30071010e62c9352cfaaf0%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r377b93d79817ce649e9e68b3456e6f499747ef1643fa987b342e082e%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r3d71f18adb78e50f626dde689161ca63d3b7491bd9718fcddfaecba7%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r50e9c9466c592ca9d707a5dea549524d19e3287da08d8392f643960e%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r685c5235235ad0c26e86d0ee987fb802c9675de6081dbf0516464e0b%40%3Cnotifications.james.apache.org%3E","https://lists.apache.org/thread.html/r97404676a5cf591988faedb887d64e278f522adcaa823d89ca69defe%40%3Cnotifications.james.apache.org%3E","https://lists.apache.org/thread.html/rc3354080fc67fb50b45b3c2d12dc4ca2a3c1c78dad3d3ba012c038aa%40%3Cnotifications.james.apache.org%3E","https://security.netapp.com/advisory/ntap-20220210-0022/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-37714","description":"jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes."}]},{"artifact":{"id":"1b0f8262f0bac2cd","cpes":["cpe:2.3:a:git:git:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:deb/debian/git@1%3A2.1.4-2.1%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.conffiles","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.list"},{"path":"/var/lib/dpkg/info/git.postinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postinst"},{"path":"/var/lib/dpkg/info/git.postrm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.postrm"},{"path":"/var/lib/dpkg/info/git.preinst","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.preinst"},{"path":"/var/lib/dpkg/info/git.prerm","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-5260","versionConstraint":"< 1:2.1.4-2.1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-5260","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-10-10","epss":0.09966,"percentile":0.95498}],"risk":4.983,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-5260"},"relatedVulnerabilities":[{"id":"CVE-2020-5260","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.3,"impactScore":5.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-10-10","epss":0.09966,"percentile":0.95498}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html","http://www.openwall.com/lists/oss-security/2020/04/15/5","http://www.openwall.com/lists/oss-security/2020/04/15/6","http://www.openwall.com/lists/oss-security/2020/04/20/1","https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/","https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/","https://security.gentoo.org/glsa/202004-13","https://support.apple.com/kb/HT211141","https://usn.ubuntu.com/4329-1/","https://www.debian.org/security/2020/dsa-4657"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5260","description":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1."}]},{"artifact":{"id":"c887d301ab2f172c","cpes":["cpe:2.3:a:git-man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git-man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git_man:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git-man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:git:git_man:1\\:2.1.4-2.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"git-man","purl":"pkg:deb/debian/git-man@1%3A2.1.4-2.1%2Bdeb8u2?arch=all&distro=debian-8.5&upstream=git","type":"deb","version":"1:2.1.4-2.1+deb8u2","language":"","licenses":["Apache-2.0","Artistic","BSD-2-clause","Boost","EDL-1.0","Expat","GPL","GPL-1+","GPL-2","GPL-2+","ISC","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","dlmalloc","mingw-runtime"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/git-man/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/git-man/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/git-man.list","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/git-man.list"}],"upstreams":[{"name":"git"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.1.4-2.1+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-5260","versionConstraint":"< 1:2.1.4-2.1+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"git","version":"1:2.1.4-2.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-5260","fix":{"state":"fixed","versions":["1:2.1.4-2.1+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:2.1.4-2.1+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-10-10","epss":0.09966,"percentile":0.95498}],"risk":4.983,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-5260"},"relatedVulnerabilities":[{"id":"CVE-2020-5260","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.3,"impactScore":5.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-5260","cwe":"CWE-20","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2020-5260","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-5260","date":"2026-10-10","epss":0.09966,"percentile":0.95498}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html","http://packetstormsecurity.com/files/157250/Git-Credential-Helper-Protocol-Newline-Injection.html","http://www.openwall.com/lists/oss-security/2020/04/15/5","http://www.openwall.com/lists/oss-security/2020/04/15/6","http://www.openwall.com/lists/oss-security/2020/04/20/1","https://github.com/git/git/commit/9a6bbee8006c24b46a85d29e7b38cfa79e9ab21b","https://github.com/git/git/security/advisories/GHSA-qm7j-c969-7j4q","https://lists.debian.org/debian-lts-announce/2020/04/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/74Q7WVJ6FKLIN62VS2JD2XCNWK5TNKOW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7TVS5UG6JD3MYIGSBKMIOS6AF7CR5IPI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MOCTR2SEHCPSCOVUQJAGFPGKFMI2VE6V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN3FUOXKX3AXTULYV53ACABER2W2FSOU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPCEOIFLLEF24L6GLVJVFZX4CREDEHDF/","https://lore.kernel.org/git/xmqqy2qy7xn8.fsf%40gitster.c.googlers.com/","https://security.gentoo.org/glsa/202004-13","https://support.apple.com/kb/HT211141","https://usn.ubuntu.com/4329-1/","https://www.debian.org/security/2020/dsa-4657"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-5260","description":"Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external \"credential helper\" programs to store and retrieve passwords or other credentials from secure storage provided by the operating system. Specially-crafted URLs that contain an encoded newline can inject unintended values into the credential helper protocol stream, causing the credential helper to retrieve the password for one server (e.g., good.example.com) for an HTTP request being made to another server (e.g., evil.example.com), resulting in credentials for the former being sent to the latter. There are no restrictions on the relationship between the two, meaning that an attacker can craft a URL that will present stored credentials for any host to a host of their choosing. The vulnerability can be triggered by feeding a malicious URL to git clone. However, the affected URLs look rather suspicious; the likely vector would be through systems which automatically clone URLs not visible to the user, such as Git submodules, or package systems built around Git. The problem has been patched in the versions published on April 14th, 2020, going back to v2.17.x. Anyone wishing to backport the change further can do so by applying commit 9a6bbee (the full release includes extra checks for git fsck, but that commit is sufficient to protect clients against the vulnerability). The patched versions are: 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26.1."}]},{"artifact":{"id":"8c073cd8c0fb539c","cpes":["cpe:2.3:a:metastuff-ltd-:dom4j:1.4:*:*:*:*:*:*:*","cpe:2.3:a:metastuff_ltd_:dom4j:1.4:*:*:*:*:*:*:*","cpe:2.3:a:org.dom4j:dom4j:1.4:*:*:*:*:*:*:*","cpe:2.3:a:dom4j:dom4j:1.4:*:*:*:*:*:*:*"],"name":"dom4j","purl":"pkg:maven/org.dom4j/dom4j@1.4","type":"java-archive","version":"1.4","language":"java","licenses":[],"metadata":{"pomGroupID":"org.dom4j","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/dom4j-1.4.jar","manifestName":"","pomArtifactID":"dom4j","archiveDigests":[{"value":"8decb7e2c04c9340375aaf7dd43a7a6a9b9a46b1","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/dom4j-1.4.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/dom4j-1.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.0.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6pcc-3rfx-4gpm","versionConstraint":"<2.0.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.dom4j:dom4j","version":"1.4"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6pcc-3rfx-4gpm","fix":{"state":"fixed","versions":["2.0.3"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"2.0.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000632","cwe":"CWE-91","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000632","date":"2026-10-10","epss":0.0657,"percentile":0.93667}],"risk":4.9275,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-1000632","https://github.com/dom4j/dom4j/issues/48","https://github.com/dom4j/dom4j/commit/c2a99d7dee8ce7a4e5bef134bb781a6672bd8a0f","https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387","https://ihacktoprotect.com/post/dom4j-xml-injection/","https://access.redhat.com/errata/RHSA-2019:0362","https://access.redhat.com/errata/RHSA-2019:0364","https://access.redhat.com/errata/RHSA-2019:0365","https://access.redhat.com/errata/RHSA-2019:0380","https://access.redhat.com/errata/RHSA-2019:1159","https://access.redhat.com/errata/RHSA-2019:1160","https://access.redhat.com/errata/RHSA-2019:1161","https://access.redhat.com/errata/RHSA-2019:1162","https://access.redhat.com/errata/RHSA-2019:3172","https://lists.apache.org/thread.html/00571f362a7a2470fba50a31282c65637c40d2e21ebe6ee535a4ed74@%3Ccommits.maven.apache.org%3E","https://lists.apache.org/thread.html/4a77652531d62299a30815cf5f233af183425db8e3c9a824a814e768@%3Cdev.maven.apache.org%3E","https://lists.apache.org/thread.html/5a020ecaa3c701f408f612f7ba2ee37a021644c4a39da2079ed3ddbc@%3Ccommits.maven.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/7e9e78f0e4288fac6591992836d2a80d4df19161e54bd71ab4b8e458@%3Cdev.maven.apache.org%3E","https://lists.apache.org/thread.html/7f6e120e6ed473f4e00dde4c398fc6698eb383bd7857d20513e989ce@%3Cdev.maven.apache.org%3E","https://lists.apache.org/thread.html/9d4c1af6f702c3d6d6f229de57112ddccac8ce44446a01b7937ab9e0@%3Ccommits.maven.apache.org%3E","https://lists.apache.org/thread.html/d7d960b2778e35ec9b4d40c8efd468c7ce7163bcf6489b633491c89f@%3Cdev.maven.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/09/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IOOVVCRQE6ATFD2JM2EMDXOQXTRIVZGP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJULAHVR3I5SX7OSMXAG75IMNSAYOXGA/","https://security.netapp.com/advisory/ntap-20190530-0001/","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51@%3Cnotifications.freemarker.apache.org%3E"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6pcc-3rfx-4gpm","description":"Dom4j contains a XML Injection vulnerability"},"relatedVulnerabilities":[{"id":"CVE-2018-1000632","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000632","cwe":"CWE-91","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000632","date":"2026-10-10","epss":0.0657,"percentile":0.93667}],"urls":["https://access.redhat.com/errata/RHSA-2019:0362","https://access.redhat.com/errata/RHSA-2019:0364","https://access.redhat.com/errata/RHSA-2019:0365","https://access.redhat.com/errata/RHSA-2019:0380","https://access.redhat.com/errata/RHSA-2019:1159","https://access.redhat.com/errata/RHSA-2019:1160","https://access.redhat.com/errata/RHSA-2019:1161","https://access.redhat.com/errata/RHSA-2019:1162","https://access.redhat.com/errata/RHSA-2019:3172","https://github.com/dom4j/dom4j/commit/e598eb43d418744c4dbf62f647dd2381c9ce9387","https://github.com/dom4j/dom4j/issues/48","https://ihacktoprotect.com/post/dom4j-xml-injection/","https://lists.apache.org/thread.html/00571f362a7a2470fba50a31282c65637c40d2e21ebe6ee535a4ed74%40%3Ccommits.maven.apache.org%3E","https://lists.apache.org/thread.html/4a77652531d62299a30815cf5f233af183425db8e3c9a824a814e768%40%3Cdev.maven.apache.org%3E","https://lists.apache.org/thread.html/5a020ecaa3c701f408f612f7ba2ee37a021644c4a39da2079ed3ddbc%40%3Ccommits.maven.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/7e9e78f0e4288fac6591992836d2a80d4df19161e54bd71ab4b8e458%40%3Cdev.maven.apache.org%3E","https://lists.apache.org/thread.html/7f6e120e6ed473f4e00dde4c398fc6698eb383bd7857d20513e989ce%40%3Cdev.maven.apache.org%3E","https://lists.apache.org/thread.html/9d4c1af6f702c3d6d6f229de57112ddccac8ce44446a01b7937ab9e0%40%3Ccommits.maven.apache.org%3E","https://lists.apache.org/thread.html/d7d960b2778e35ec9b4d40c8efd468c7ce7163bcf6489b633491c89f%40%3Cdev.maven.apache.org%3E","https://lists.apache.org/thread.html/rb1b990d7920ae0d50da5109b73b92bab736d46c9788dd4b135cb1a51%40%3Cnotifications.freemarker.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/09/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOOVVCRQE6ATFD2JM2EMDXOQXTRIVZGP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJULAHVR3I5SX7OSMXAG75IMNSAYOXGA/","https://security.netapp.com/advisory/ntap-20190530-0001/","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000632","description":"dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wh8g-3j2c-rqj5","versionConstraint":">=2.0.0,<=2.9.10.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wh8g-3j2c-rqj5","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2021-12-10","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35490","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35490","date":"2026-10-10","epss":0.06285,"percentile":0.93427}],"risk":4.9023,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-35490","https://github.com/FasterXML/jackson-databind/issues/2986","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/41b8bdb5ccc1d8edb71acf1c8234da235a24249d","https://security.netapp.com/advisory/ntap-20210122-0005"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wh8g-3j2c-rqj5","description":"Serialization gadgets exploit in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-35490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35490","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35490","date":"2026-10-10","epss":0.06285,"percentile":0.93427}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2986","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210122-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35490","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-wh8g-3j2c-rqj5","versionConstraint":">=2.0.0,<=2.9.10.7 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-wh8g-3j2c-rqj5","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2021-12-10","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35490","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35490","date":"2026-10-10","epss":0.06285,"percentile":0.93427}],"risk":4.9023,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-35490","https://github.com/FasterXML/jackson-databind/issues/2986","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/41b8bdb5ccc1d8edb71acf1c8234da235a24249d","https://security.netapp.com/advisory/ntap-20210122-0005"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-wh8g-3j2c-rqj5","description":"Serialization gadgets exploit in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-35490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-35490","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-35490","date":"2026-10-10","epss":0.06285,"percentile":0.93427}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2986","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210122-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-35490","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource."}]},{"artifact":{"id":"17522b2e6a863e34","cpes":["cpe:2.3:a:http\\:\\/\\/fasterxml-com:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:http\\:\\/\\/fasterxml-com:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:http\\:\\/\\/fasterxml_com:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:http\\:\\/\\/fasterxml_com:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:org.codehaus.jackson:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:org.codehaus.jackson:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson-mapper-asl:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson-mapper-asl:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson_mapper_asl:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson_mapper_asl:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson-mapper:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson-mapper:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson_mapper:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson_mapper:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:http\\:\\/\\/fasterxml-com:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:http\\:\\/\\/fasterxml_com:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:org.codehaus.jackson:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:codehaus:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:codehaus:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson-mapper-asl:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-mapper-asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_mapper_asl:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson_mapper_asl:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson-mapper:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson_mapper:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:codehaus:jackson:1.9.13:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:1.9.13:*:*:*:*:*:*:*"],"name":"jackson-mapper-asl","purl":"pkg:maven/org.codehaus.jackson/jackson-mapper-asl@1.9.13","type":"java-archive","version":"1.9.13","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.codehaus.jackson","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/jackson-mapper-asl-1.9.13.jar","manifestName":"","pomArtifactID":"jackson-mapper-asl","archiveDigests":[{"value":"1ee2f2bed0e5dd29d1cb155a166e6f8d50bbddb7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/jackson-mapper-asl-1.9.13.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/jackson-mapper-asl-1.9.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-c27h-mcmw-48hv","versionConstraint":"<=1.9.13 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.codehaus.jackson:jackson-mapper-asl","version":"1.9.13"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-c27h-mcmw-48hv","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10202","cwe":"CWE-502","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10202","cwe":"CWE-502","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10202","date":"2026-10-10","epss":0.05175,"percentile":0.92254}],"risk":4.8645000000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-10202","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10202","https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581@%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9@%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/refea6018a2c4e9eb7838cab567ed219c3f726dcd83a5472fbb80d8d9@%3Cissues.flume.apache.org%3E","https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/refea6018a2c4e9eb7838cab567ed219c3f726dcd83a5472fbb80d8d9%40%3Cissues.flume.apache.org%3E"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-c27h-mcmw-48hv","description":"Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl"},"relatedVulnerabilities":[{"id":"CVE-2019-10202","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-10202","cwe":"CWE-502","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-10202","cwe":"CWE-502","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-10202","date":"2026-10-10","epss":0.05175,"percentile":0.92254}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10202","https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/refea6018a2c4e9eb7838cab567ed219c3f726dcd83a5472fbb80d8d9%40%3Cissues.flume.apache.org%3E"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10202","description":"A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike."}]},{"artifact":{"id":"57469482e26b9740","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-10","epss":0.06477,"percentile":0.93589}],"risk":4.857749999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6797"},"relatedVulnerabilities":[{"id":"CVE-2018-6797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-10","epss":0.06477,"percentile":0.93589}],"urls":["http://www.securitytracker.com/id/1040681","http://www.securitytracker.com/id/1042004","https://access.redhat.com/errata/RHSA-2018:1192","https://rt.perl.org/Public/Bug/Display.html?id=132227","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6797","description":"An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written."}]},{"artifact":{"id":"71183f78a986047d","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-10","epss":0.06477,"percentile":0.93589}],"risk":4.857749999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6797"},"relatedVulnerabilities":[{"id":"CVE-2018-6797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-10","epss":0.06477,"percentile":0.93589}],"urls":["http://www.securitytracker.com/id/1040681","http://www.securitytracker.com/id/1042004","https://access.redhat.com/errata/RHSA-2018:1192","https://rt.perl.org/Public/Bug/Display.html?id=132227","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6797","description":"An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written."}]},{"artifact":{"id":"16a442ba7a1a09d3","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u6?arch=all&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-10","epss":0.06477,"percentile":0.93589}],"risk":4.857749999999999,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6797"},"relatedVulnerabilities":[{"id":"CVE-2018-6797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-10","epss":0.06477,"percentile":0.93589}],"urls":["http://www.securitytracker.com/id/1040681","http://www.securitytracker.com/id/1042004","https://access.redhat.com/errata/RHSA-2018:1192","https://rt.perl.org/Public/Bug/Display.html?id=132227","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6797","description":"An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-85cw-hj65-qqv9","versionConstraint":"<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-85cw-hj65-qqv9","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2023-09-14","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16335","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16335","date":"2026-10-10","epss":0.04958,"percentile":0.91974}],"risk":4.66052,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-16335","https://github.com/FasterXML/jackson-databind/issues/2449","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://access.redhat.com/errata/RHSA-2020:0729","https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb@%3Ccommits.hbase.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20191004-0002/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-85cw-hj65-qqv9","description":"Polymorphic Typing issue in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-16335","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16335","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16335","date":"2026-10-10","epss":0.04958,"percentile":0.91974}],"urls":["https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://access.redhat.com/errata/RHSA-2020:0729","https://github.com/FasterXML/jackson-databind/issues/2449","https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb%40%3Ccommits.hbase.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20191004-0002/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16335","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-85cw-hj65-qqv9","versionConstraint":"<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-85cw-hj65-qqv9","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2023-09-14","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16335","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16335","date":"2026-10-10","epss":0.04958,"percentile":0.91974}],"risk":4.66052,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-16335","https://github.com/FasterXML/jackson-databind/issues/2449","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://access.redhat.com/errata/RHSA-2020:0729","https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0@%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb@%3Ccommits.hbase.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20191004-0002/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/73c1c2cc76e6cdd7f3a5615cbe3207fe96e4d3db"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-85cw-hj65-qqv9","description":"Polymorphic Typing issue in FasterXML jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-16335","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16335","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-16335","date":"2026-10-10","epss":0.04958,"percentile":0.91974}],"urls":["https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://access.redhat.com/errata/RHSA-2020:0729","https://github.com/FasterXML/jackson-databind/issues/2449","https://lists.apache.org/thread.html/0fcef7321095ce0bc597d468d150cff3d647f4cb3aef3bd4d20e1c69%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/40c00861b53bb611dee7d6f35f864aa7d1c1bd77df28db597cbf27e1%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/a360b46061c91c5cad789b6c3190aef9b9f223a2b75c9c9f046fe016%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/ad0d238e97a7da5eca47a014f0f7e81f440ed6bf74a93183825e18b9%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/dc6b5cad721a4f6b3b62ed1163894941140d9d5656140fb757505ca0%40%3Cissues.hbase.apache.org%3E","https://lists.apache.org/thread.html/e90c3feb21702e68a8c08afce37045adb3870f2bf8223fa403fb93fb%40%3Ccommits.hbase.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20191004-0002/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16335","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540."}]},{"artifact":{"id":"4a6fc25b02170f2a","cpes":["cpe:2.3:a:apache:httpclient:4.0:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.0","type":"java-archive","version":"4.0","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:httpclient-osgi-4.0.jar:httpclient-4.0.jar","manifestName":"","pomArtifactID":"httpclient","archiveDigests":[{"value":"a76d7fd8033d48b4c67b4ccf159abb080c1059b6","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:httpclient-osgi-4.0.jar:httpclient-4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.5.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7r82-7xv7-xcpj","versionConstraint":"<4.5.13 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7r82-7xv7-xcpj","fix":{"state":"fixed","versions":["4.5.13"],"available":[{"date":"2021-06-04","kind":"first-observed","version":"4.5.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"risk":4.65148,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-13956","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2022.html","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7r82-7xv7-xcpj","description":"Cross-site scripting in Apache HttpClient"},"relatedVulnerabilities":[{"id":"CVE-2020-13956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"urls":["https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d%40%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381%40%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3%40%3Cissues.hive.apache.org%3E","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://priyankn.github.io/2021-02-26-CVE-2020-13956/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13956","description":"Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution."}]},{"artifact":{"id":"9bdc2593baa750a4","cpes":["cpe:2.3:a:apache:httpclient:4.2:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.2","type":"java-archive","version":"4.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:org.apache.httpcomponents:httpclient","manifestName":"","pomArtifactID":"httpclient","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.5.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7r82-7xv7-xcpj","versionConstraint":"<4.5.13 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7r82-7xv7-xcpj","fix":{"state":"fixed","versions":["4.5.13"],"available":[{"date":"2021-06-04","kind":"first-observed","version":"4.5.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"risk":4.65148,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-13956","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2022.html","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7r82-7xv7-xcpj","description":"Cross-site scripting in Apache HttpClient"},"relatedVulnerabilities":[{"id":"CVE-2020-13956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"urls":["https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d%40%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381%40%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3%40%3Cissues.hive.apache.org%3E","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://priyankn.github.io/2021-02-26-CVE-2020-13956/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13956","description":"Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution."}]},{"artifact":{"id":"b6445c8da33c33ef","cpes":["cpe:2.3:a:apache:httpclient:4.2.6:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.2.6","type":"java-archive","version":"4.2.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/httpclient-4.2.6.jar","manifestName":"","pomArtifactID":"httpclient","archiveDigests":[{"value":"e4ca30a6a3a075053a61c6fc850d2432dc012ba7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/httpclient-4.2.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.5.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7r82-7xv7-xcpj","versionConstraint":"<4.5.13 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.2.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7r82-7xv7-xcpj","fix":{"state":"fixed","versions":["4.5.13"],"available":[{"date":"2021-06-04","kind":"first-observed","version":"4.5.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"risk":4.65148,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-13956","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2022.html","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7r82-7xv7-xcpj","description":"Cross-site scripting in Apache HttpClient"},"relatedVulnerabilities":[{"id":"CVE-2020-13956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"urls":["https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d%40%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381%40%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3%40%3Cissues.hive.apache.org%3E","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://priyankn.github.io/2021-02-26-CVE-2020-13956/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13956","description":"Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution."}]},{"artifact":{"id":"48b65df626e72234","cpes":["cpe:2.3:a:apache:httpclient:4.3.2:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.3.2","type":"java-archive","version":"4.3.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-httpclient-plugin-0.21.4.jar:org.apache.httpcomponents:httpclient","manifestName":"","pomArtifactID":"httpclient","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-httpclient-plugin-0.21.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.5.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7r82-7xv7-xcpj","versionConstraint":"<4.5.13 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7r82-7xv7-xcpj","fix":{"state":"fixed","versions":["4.5.13"],"available":[{"date":"2021-06-04","kind":"first-observed","version":"4.5.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"risk":4.65148,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-13956","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2022.html","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7r82-7xv7-xcpj","description":"Cross-site scripting in Apache HttpClient"},"relatedVulnerabilities":[{"id":"CVE-2020-13956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"urls":["https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d%40%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381%40%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3%40%3Cissues.hive.apache.org%3E","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://priyankn.github.io/2021-02-26-CVE-2020-13956/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13956","description":"Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution."}]},{"artifact":{"id":"6bf2e5628409528b","cpes":["cpe:2.3:a:apache:httpclient:4.3.5:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.3.5","type":"java-archive","version":"4.3.5","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-universal-plugin-manager-plugin-2.18.4.jar:org.apache.httpcomponents:httpclient","manifestName":"","pomArtifactID":"httpclient","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-universal-plugin-manager-plugin-2.18.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.5.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7r82-7xv7-xcpj","versionConstraint":"<4.5.13 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.3.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7r82-7xv7-xcpj","fix":{"state":"fixed","versions":["4.5.13"],"available":[{"date":"2021-06-04","kind":"first-observed","version":"4.5.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"risk":4.65148,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-13956","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2022.html","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7r82-7xv7-xcpj","description":"Cross-site scripting in Apache HttpClient"},"relatedVulnerabilities":[{"id":"CVE-2020-13956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"urls":["https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d%40%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381%40%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3%40%3Cissues.hive.apache.org%3E","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://priyankn.github.io/2021-02-26-CVE-2020-13956/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13956","description":"Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution."}]},{"artifact":{"id":"368dea55638c1c05","cpes":["cpe:2.3:a:apache:httpclient:4.3.6:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.3.6","type":"java-archive","version":"4.3.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-nav-links-plugin-3.3.21.jar:META-INF/lib/httpclient-4.3.6.jar","manifestName":"","pomArtifactID":"httpclient","archiveDigests":[{"value":"4c47155e3e6c9a41a28db36680b828ced53b8af4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-nav-links-plugin-3.3.21.jar:META-INF/lib/httpclient-4.3.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.5.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7r82-7xv7-xcpj","versionConstraint":"<4.5.13 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.3.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7r82-7xv7-xcpj","fix":{"state":"fixed","versions":["4.5.13"],"available":[{"date":"2021-06-04","kind":"first-observed","version":"4.5.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"risk":4.65148,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-13956","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2022.html","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7r82-7xv7-xcpj","description":"Cross-site scripting in Apache HttpClient"},"relatedVulnerabilities":[{"id":"CVE-2020-13956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"urls":["https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d%40%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381%40%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3%40%3Cissues.hive.apache.org%3E","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://priyankn.github.io/2021-02-26-CVE-2020-13956/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13956","description":"Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution."}]},{"artifact":{"id":"c60f3ac5be803dab","cpes":["cpe:2.3:a:apache:httpclient:4.4.1:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.4.1","type":"java-archive","version":"4.4.1","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/httpclient-4.4.1.jar","manifestName":"","pomArtifactID":"httpclient","archiveDigests":[{"value":"016d0bc512222f1253ee6b64d389c84e22f697f0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/httpclient-4.4.1.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/httpclient-4.4.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.5.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-7r82-7xv7-xcpj","versionConstraint":"<4.5.13 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.4.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-7r82-7xv7-xcpj","fix":{"state":"fixed","versions":["4.5.13"],"available":[{"date":"2021-06-04","kind":"first-observed","version":"4.5.13"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"risk":4.65148,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-13956","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9@%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381@%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8@%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4@%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f@%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3@%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d@%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f@%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1@%3Ccommits.creadur.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17@%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624@%3Cissues.solr.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30@%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1@%3Cissues.solr.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19@%3Cdev.ranger.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2022.html","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-7r82-7xv7-xcpj","description":"Cross-site scripting in Apache HttpClient"},"relatedVulnerabilities":[{"id":"CVE-2020-13956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-13956","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-13956","date":"2026-10-10","epss":0.09032,"percentile":0.95173}],"urls":["https://lists.apache.org/thread.html/r03bbc318c81be21f5c8a9b85e34f2ecc741aa804a8e43b0ef2c37749%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r043a75acdeb52b15dd5e9524cdadef4202e6a5228644206acf9363f9%40%3Cdev.hive.apache.org%3E","https://lists.apache.org/thread.html/r06cf3ca5c8ceb94b39cd24a73d4e96153b485a7dac88444dd876accb%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r0a75b8f0f72f3e18442dc56d33f3827b905f2fe5b7ba48997436f5d1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r0bebe6f9808ac7bdf572873b4fa96a29c6398c90dab29f131f3ebffe%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r12cb62751b35bdcda0ae2a08b67877d665a1f4d41eee0fa7367169e0%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r132e4c6a560cfc519caa1aaee63bdd4036327610eadbd89f76dd5457%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2835543ef0f91adcc47da72389b816e36936f584c7be584d2314fac3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r2a03dc210231d7e852ef73015f71792ac0fcaca6cccc024c522ef17d%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r2dc7930b43eadc78220d269b79e13ecd387e4bee52db67b2f47d4303%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/r34178ab6ef106bc940665fd3f4ba5026fac3603b3fa2aefafa0b619d%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r34efec51cb817397ccf9f86e25a75676d435ba5f83ee7b2eabdad707%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r3cecd59fba74404cbf4eb430135e1080897fb376f111406a78bed13a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r3f740e4c38bba1face49078aa5cbeeb558c27be601cc9712ad2dcd1e%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r4850b3fbaea02fde2886e461005e4af8d37c80a48b3ce2a6edca0e30%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r549ac8c159bf0c568c19670bedeb8d7c0074beded951d34b1c1d0d05%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r55b2a1d1e9b1ec9db792b93da8f0f99a4fd5a5310b02673359d9b4d1%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/r5b55f65c123a7481104d663a915ec45a0d103e6aaa03f42ed1c07a89%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/r5de3d3808e7b5028df966e45115e006456c4e8931dc1e29036f17927%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r5fec9c1d67f928179adf484b01e7becd7c0a6fdfe3a08f92ea743b90%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/r63296c45d5d84447babaf39bd1487329d8a80d8d563e67a4b6f3d8a7%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r69a94e2f302d1b778bdfefe90fcb4b8c50b226438c3c8c1d0de85a19%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/r6a3cda38d050ebe13c1bc9a28d0a8ec38945095d07eca49046bcb89f%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/r6d672b46622842e565e00f6ef6bef83eb55d8792aac2bee75bff9a2a%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r6dab7da30f8bf075f79ee189e33b45a197502e2676481bb8787fc0d7%40%3Cdev.hc.apache.org%3E","https://lists.apache.org/thread.html/r6eb2dae157dbc9af1f30d1f64e9c60d4ebef618f3dce4a0e32d6ea4d%40%3Ccommits.drill.apache.org%3E","https://lists.apache.org/thread.html/r70c429923100c5a4fae8e5bc71c8a2d39af3de4888f50a0ac3755e6f%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/r87ddc09295c27f25471269ad0a79433a91224045988b88f0413a97ec%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r8aa1e5c343b89aec5b69961471950e862f15246cb6392910161c389b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r9e52a6c72c8365000ecd035e48cc9fee5a677a150350d4420c46443d%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/ra539f20ef0fb0c27ee39945b5f56bf162e5c13d1c60f7344dab8de3b%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/ra8bc6b61c5df301a6fe5a716315528ecd17ccb8a7f907e24a47a1a5e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rad6222134183046f3928f733bf680919e0c390739bfbfe6c90049673%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/rae14ae25ff4a60251e3ba2629c082c5ba3851dfd4d21218b99b56652%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rb33212dab7beccaf1ffef9b88610047c644f644c7a0ebdc44d77e381%40%3Ccommits.turbine.apache.org%3E","https://lists.apache.org/thread.html/rb4ba262d6f08ab9cf8b1ebbcd9b00b0368ffe90dad7ad7918b4b56fc%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rb725052404fabffbe093c83b2c46f3f87e12c3193a82379afbc529f8%40%3Csolr-user.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc0863892ccfd9fd0d0ae10091f24ee769fb39b8957fe4ebabfc11f17%40%3Cdev.jackrabbit.apache.org%3E","https://lists.apache.org/thread.html/rc3739e0ad4bcf1888c6925233bfc37dd71156bbc8416604833095c42%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rc505fee574fe8d18f9b0c655a4d120b0ae21bb6a73b96003e1d9be35%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rc5c6ccb86d2afe46bbd4b71573f0448dc1f87bbcd5a0d8c7f8f904b2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc990e2462ec32b09523deafb2c73606208599e196fa2d7f50bdbc587%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/rcced7ed3237c29cd19c1e9bf465d0038b8b2e967b99fc283db7ca553%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rcd9ad5dda60c82ab0d0c9bd3e9cb1dc740804451fc20c7f451ef5cc4%40%3Cgitbox.hive.apache.org%3E","https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd5ab56beb2ac6879f6ab427bc4e5f7691aed8362d17b713f61779858%40%3Cissues.hive.apache.org%3E","https://lists.apache.org/thread.html/re504acd4d63b8df2a7353658f45c9a3137e5f80e41cf7de50058b2c1%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rea3dbf633dde5008d38bf6600a3738b9216e733e03f9ff7becf79625%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ree942561f4620313c75982a4e5f3b74fe6f7062b073210779648eec2%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/reef569c2419705754a3acf42b5f19b2a158153cef0e448158bc54917%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/rf03228972e56cb4a03e6d9558188c2938078cf3ceb23a3fead87c9ca%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf43d17ed0d1fb4fb79036b582810ef60b18b1ef3add0d5dea825af1e%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf4db88c22e1be9eb60c7dc623d0528642c045fb196a24774ac2fa3a3%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rf7ca60f78f05b772cc07d27e31bcd112f9910a05caf9095e38ee150f%40%3Cdev.ranger.apache.org%3E","https://lists.apache.org/thread.html/rfb35f6db9ba1f1e061b63769a4eff5abadcc254ebfefc280e5a0dcf1%40%3Ccommits.creadur.apache.org%3E","https://lists.apache.org/thread.html/rfbedcb586a1e7dfce87ee03c720e583fc2ceeafa05f35c542cecc624%40%3Cissues.solr.apache.org%3E","https://lists.apache.org/thread.html/rfc00884c7b7ca878297bffe45fcb742c362b00b26ba37070706d44c3%40%3Cissues.hive.apache.org%3E","https://security.netapp.com/advisory/ntap-20220210-0002/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://priyankn.github.io/2021-02-26-CVE-2020-13956/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-13956","description":"Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution."}]},{"artifact":{"id":"086860a1c675b6eb","cpes":["cpe:2.3:a:libgnutls-deb0-28:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0-28:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*"],"name":"libgnutls-deb0-28","purl":"pkg:deb/debian/libgnutls-deb0-28@3.3.8-6%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=gnutls28","type":"deb","version":"3.3.8-6+deb8u3","language":"","licenses":["sha256:cffad6d97811bc8c8755b86819dbece70c2da355bf2d50a24bdc0e85a6cc2fef"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-deb0-28/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libgnutls-deb0-28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.3.8-6+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5337","versionConstraint":"< 3.3.8-6+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"gnutls28","version":"3.3.8-6+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-5337","fix":{"state":"fixed","versions":["3.3.8-6+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.3.8-6+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5337","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5337","date":"2026-10-10","epss":0.06179,"percentile":0.93326}],"risk":4.63425,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-5337"},"relatedVulnerabilities":[{"id":"CVE-2017-5337","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5337","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5337","date":"2026-10-10","epss":0.06179,"percentile":0.93326}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://www.openwall.com/lists/oss-security/2017/01/10/7","http://www.openwall.com/lists/oss-security/2017/01/11/4","http://www.securityfocus.com/bid/95372","http://www.securitytracker.com/id/1037576","https://access.redhat.com/errata/RHSA-2017:2292","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=338","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=346","https://gitlab.com/gnutls/gnutls/commit/94fcf1645ea17223237aaf8d19132e004afddc1a","https://gnutls.org/security.html#GNUTLS-SA-2017-2","https://security.gentoo.org/glsa/201702-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5337","description":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fmmc-742q-jg75","versionConstraint":"<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fmmc-742q-jg75","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2023-09-14","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16943","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16943","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16943","date":"2026-10-10","epss":0.04901,"percentile":0.91885}],"risk":4.606940000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-16943","https://github.com/FasterXML/jackson-databind/issues/2478","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712ebcdd@%3Ccommits.iceberg.apache.org%3E","https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20191017-0006/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/FasterXML/jackson-databind/commit/328a0f833daf6baa443ac3b37c818a0204714b0b","https://github.com/FasterXML/jackson-databind/commit/bc67eb11a7cf57561f861ff16f879f1fceb5779f"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fmmc-742q-jg75","description":"jackson-databind polymorphic typing issue"},"relatedVulnerabilities":[{"id":"CVE-2019-16943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16943","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16943","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16943","date":"2026-10-10","epss":0.04901,"percentile":0.91885}],"urls":["https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://github.com/FasterXML/jackson-databind/issues/2478","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712ebcdd%40%3Ccommits.iceberg.apache.org%3E","https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20191017-0006/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16943","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fmmc-742q-jg75","versionConstraint":"<2.6.7.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fmmc-742q-jg75","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2023-09-14","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16943","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16943","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16943","date":"2026-10-10","epss":0.04901,"percentile":0.91885}],"risk":4.606940000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-16943","https://github.com/FasterXML/jackson-databind/issues/2478","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712ebcdd@%3Ccommits.iceberg.apache.org%3E","https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6@%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20191017-0006/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/FasterXML/jackson-databind/commit/328a0f833daf6baa443ac3b37c818a0204714b0b","https://github.com/FasterXML/jackson-databind/commit/bc67eb11a7cf57561f861ff16f879f1fceb5779f"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fmmc-742q-jg75","description":"jackson-databind polymorphic typing issue"},"relatedVulnerabilities":[{"id":"CVE-2019-16943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16943","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-16943","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16943","date":"2026-10-10","epss":0.04901,"percentile":0.91885}],"urls":["https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://github.com/FasterXML/jackson-databind/issues/2478","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/5ec8d8d485c2c8ac55ea425f4cd96596ef37312532712639712ebcdd%40%3Ccommits.iceberg.apache.org%3E","https://lists.apache.org/thread.html/6788e4c991f75b89d290ad06b463fcd30bcae99fee610345a35b7bc6%40%3Cissues.iceberg.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/10/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q7CANA7KV53JROZDX5Z5P26UG5VN2K43/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TH5VFUN4P7CCIP7KSEXYA5MUTFCUDUJT/","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://seclists.org/bugtraq/2019/Oct/6","https://security.netapp.com/advisory/ntap-20191017-0006/","https://www.debian.org/security/2019/dsa-4542","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16943","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling."}]},{"artifact":{"id":"66b6e98fb35d5043","cpes":["cpe:2.3:a:commons-httpclient:commons-httpclient:3.1-atlassian-2:*:*:*:*:*:*:*","cpe:2.3:a:commons-httpclient:commons_httpclient:3.1-atlassian-2:*:*:*:*:*:*:*","cpe:2.3:a:commons_httpclient:commons-httpclient:3.1-atlassian-2:*:*:*:*:*:*:*","cpe:2.3:a:commons_httpclient:commons_httpclient:3.1-atlassian-2:*:*:*:*:*:*:*","cpe:2.3:a:commons:commons-httpclient:3.1-atlassian-2:*:*:*:*:*:*:*","cpe:2.3:a:commons:commons_httpclient:3.1-atlassian-2:*:*:*:*:*:*:*"],"name":"commons-httpclient","purl":"pkg:maven/commons-httpclient/commons-httpclient@3.1-atlassian-2","type":"java-archive","version":"3.1-atlassian-2","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"commons-httpclient","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-httpclient-3.1-atlassian-2.jar","manifestName":"","pomArtifactID":"commons-httpclient","archiveDigests":[{"value":"1e4ff544b54f14355360aa5908e518f22567215e","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-httpclient-3.1-atlassian-2.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-httpclient-3.1-atlassian-2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-3832-9276-x7gf","versionConstraint":">=3.0,<4.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"commons-httpclient:commons-httpclient","version":"3.1-atlassian-2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-3832-9276-x7gf","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2012-5783","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5783","date":"2026-10-10","epss":0.09213,"percentile":0.95234}],"risk":4.6065000000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2012-5783","https://access.redhat.com/errata/RHSA-2017:0868","https://exchange.xforce.ibmcloud.com/vulnerabilities/79984","https://issues.apache.org/jira/browse/HTTPCLIENT-1265","http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html","http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html","http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html","http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html","http://rhn.redhat.com/errata/RHSA-2013-0270.html","http://rhn.redhat.com/errata/RHSA-2013-0679.html","http://rhn.redhat.com/errata/RHSA-2013-0680.html","http://rhn.redhat.com/errata/RHSA-2013-0682.html","http://rhn.redhat.com/errata/RHSA-2013-1853.html","http://rhn.redhat.com/errata/RHSA-2014-0224.html","http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf","http://www.ubuntu.com/usn/USN-2769-1"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-3832-9276-x7gf","description":"Improper Certificate Validation in Apache Commons HttpClient"},"relatedVulnerabilities":[{"id":"CVE-2012-5783","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-5783","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5783","date":"2026-10-10","epss":0.09213,"percentile":0.95234}],"urls":["http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html","http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html","http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html","http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html","http://rhn.redhat.com/errata/RHSA-2013-0270.html","http://rhn.redhat.com/errata/RHSA-2013-0679.html","http://rhn.redhat.com/errata/RHSA-2013-0680.html","http://rhn.redhat.com/errata/RHSA-2013-0681.html","http://rhn.redhat.com/errata/RHSA-2013-0682.html","http://rhn.redhat.com/errata/RHSA-2013-1147.html","http://rhn.redhat.com/errata/RHSA-2013-1853.html","http://rhn.redhat.com/errata/RHSA-2014-0224.html","http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf","http://www.securityfocus.com/bid/58073","http://www.ubuntu.com/usn/USN-2769-1","https://access.redhat.com/errata/RHSA-2017:0868","https://exchange.xforce.ibmcloud.com/vulnerabilities/79984","https://issues.apache.org/jira/browse/HTTPCLIENT-1265"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-5783","description":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000121","versionConstraint":"< 7.38.0-4+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000121","fix":{"state":"fixed","versions":["7.38.0-4+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-10","epss":0.09205,"percentile":0.95229}],"risk":4.6025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4136-1","link":"https://security-tracker.debian.org/tracker/DSA-4136-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000121"},"relatedVulnerabilities":[{"id":"CVE-2018-1000121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-10","epss":0.09205,"percentile":0.95229}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103415","http://www.securitytracker.com/id/1040529","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-97a2.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000121","description":"A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service"}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000121","versionConstraint":"< 7.38.0-4+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000121","fix":{"state":"fixed","versions":["7.38.0-4+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-10","epss":0.09205,"percentile":0.95229}],"risk":4.6025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4136-1","link":"https://security-tracker.debian.org/tracker/DSA-4136-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000121"},"relatedVulnerabilities":[{"id":"CVE-2018-1000121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-10","epss":0.09205,"percentile":0.95229}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103415","http://www.securitytracker.com/id/1040529","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-97a2.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000121","description":"A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service"}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000121","versionConstraint":"< 7.38.0-4+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000121","fix":{"state":"fixed","versions":["7.38.0-4+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-10","epss":0.09205,"percentile":0.95229}],"risk":4.6025,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4136-1","link":"https://security-tracker.debian.org/tracker/DSA-4136-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000121"},"relatedVulnerabilities":[{"id":"CVE-2018-1000121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-10","epss":0.09205,"percentile":0.95229}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103415","http://www.securitytracker.com/id/1040529","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-97a2.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000121","description":"A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service"}]},{"artifact":{"id":"4a6fc25b02170f2a","cpes":["cpe:2.3:a:apache:httpclient:4.0:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.0","type":"java-archive","version":"4.0","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:httpclient-osgi-4.0.jar:httpclient-4.0.jar","manifestName":"","pomArtifactID":"httpclient","archiveDigests":[{"value":"a76d7fd8033d48b4c67b4ccf159abb080c1059b6","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:httpclient-osgi-4.0.jar:httpclient-4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.3.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cfh5-3ghh-wfjx","versionConstraint":"<4.3.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cfh5-3ghh-wfjx","fix":{"state":"fixed","versions":["4.3.5"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.3.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-3577","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-3577","date":"2026-10-10","epss":0.09189,"percentile":0.95224}],"risk":4.5945,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2014-3577","https://access.redhat.com/solutions/1165533","https://exchange.xforce.ibmcloud.com/vulnerabilities/95327","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html","http://rhn.redhat.com/errata/RHSA-2014-1146.html","http://rhn.redhat.com/errata/RHSA-2014-1166.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1176.html","http://rhn.redhat.com/errata/RHSA-2015-1177.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://rhn.redhat.com/errata/RHSA-2016-1931.html","http://seclists.org/fulldisclosure/2014/Aug/48","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.ubuntu.com/usn/USN-2769-1","http://www.openwall.com/lists/oss-security/2021/10/06/1","https://github.com/apache/httpcomponents-client/commit/51cc67567765d67f878f0dcef61b5ded454d3122","https://security.netapp.com/advisory/ntap-20231027-0003","https://svn.apache.org/viewvc?view=revision&revision=1614064"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cfh5-3ghh-wfjx","description":"Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2014-3577","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-3577","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-3577","date":"2026-10-10","epss":0.09189,"percentile":0.95224}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html","http://rhn.redhat.com/errata/RHSA-2014-1146.html","http://rhn.redhat.com/errata/RHSA-2014-1166.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1176.html","http://rhn.redhat.com/errata/RHSA-2015-1177.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://rhn.redhat.com/errata/RHSA-2016-1931.html","http://seclists.org/fulldisclosure/2014/Aug/48","http://secunia.com/advisories/60466","http://secunia.com/advisories/60589","http://secunia.com/advisories/60713","http://www.openwall.com/lists/oss-security/2021/10/06/1","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.osvdb.org/110143","http://www.securityfocus.com/bid/69258","http://www.securitytracker.com/id/1030812","http://www.ubuntu.com/usn/USN-2769-1","https://access.redhat.com/solutions/1165533","https://exchange.xforce.ibmcloud.com/vulnerabilities/95327","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E","https://security.netapp.com/advisory/ntap-20231027-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-3577","description":"org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a \"CN=\" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the \"foo,CN=www.apache.org\" string in the O field."}]},{"artifact":{"id":"9bdc2593baa750a4","cpes":["cpe:2.3:a:apache:httpclient:4.2:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.2","type":"java-archive","version":"4.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:org.apache.httpcomponents:httpclient","manifestName":"","pomArtifactID":"httpclient","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.3.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cfh5-3ghh-wfjx","versionConstraint":"<4.3.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cfh5-3ghh-wfjx","fix":{"state":"fixed","versions":["4.3.5"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.3.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-3577","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-3577","date":"2026-10-10","epss":0.09189,"percentile":0.95224}],"risk":4.5945,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2014-3577","https://access.redhat.com/solutions/1165533","https://exchange.xforce.ibmcloud.com/vulnerabilities/95327","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html","http://rhn.redhat.com/errata/RHSA-2014-1146.html","http://rhn.redhat.com/errata/RHSA-2014-1166.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1176.html","http://rhn.redhat.com/errata/RHSA-2015-1177.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://rhn.redhat.com/errata/RHSA-2016-1931.html","http://seclists.org/fulldisclosure/2014/Aug/48","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.ubuntu.com/usn/USN-2769-1","http://www.openwall.com/lists/oss-security/2021/10/06/1","https://github.com/apache/httpcomponents-client/commit/51cc67567765d67f878f0dcef61b5ded454d3122","https://security.netapp.com/advisory/ntap-20231027-0003","https://svn.apache.org/viewvc?view=revision&revision=1614064"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cfh5-3ghh-wfjx","description":"Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2014-3577","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-3577","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-3577","date":"2026-10-10","epss":0.09189,"percentile":0.95224}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html","http://rhn.redhat.com/errata/RHSA-2014-1146.html","http://rhn.redhat.com/errata/RHSA-2014-1166.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1176.html","http://rhn.redhat.com/errata/RHSA-2015-1177.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://rhn.redhat.com/errata/RHSA-2016-1931.html","http://seclists.org/fulldisclosure/2014/Aug/48","http://secunia.com/advisories/60466","http://secunia.com/advisories/60589","http://secunia.com/advisories/60713","http://www.openwall.com/lists/oss-security/2021/10/06/1","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.osvdb.org/110143","http://www.securityfocus.com/bid/69258","http://www.securitytracker.com/id/1030812","http://www.ubuntu.com/usn/USN-2769-1","https://access.redhat.com/solutions/1165533","https://exchange.xforce.ibmcloud.com/vulnerabilities/95327","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E","https://security.netapp.com/advisory/ntap-20231027-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-3577","description":"org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a \"CN=\" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the \"foo,CN=www.apache.org\" string in the O field."}]},{"artifact":{"id":"b6445c8da33c33ef","cpes":["cpe:2.3:a:apache:httpclient:4.2.6:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.2.6","type":"java-archive","version":"4.2.6","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/httpclient-4.2.6.jar","manifestName":"","pomArtifactID":"httpclient","archiveDigests":[{"value":"e4ca30a6a3a075053a61c6fc850d2432dc012ba7","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/httpclient-4.2.6.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.3.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cfh5-3ghh-wfjx","versionConstraint":"<4.3.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.2.6"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cfh5-3ghh-wfjx","fix":{"state":"fixed","versions":["4.3.5"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.3.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-3577","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-3577","date":"2026-10-10","epss":0.09189,"percentile":0.95224}],"risk":4.5945,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2014-3577","https://access.redhat.com/solutions/1165533","https://exchange.xforce.ibmcloud.com/vulnerabilities/95327","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html","http://rhn.redhat.com/errata/RHSA-2014-1146.html","http://rhn.redhat.com/errata/RHSA-2014-1166.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1176.html","http://rhn.redhat.com/errata/RHSA-2015-1177.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://rhn.redhat.com/errata/RHSA-2016-1931.html","http://seclists.org/fulldisclosure/2014/Aug/48","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.ubuntu.com/usn/USN-2769-1","http://www.openwall.com/lists/oss-security/2021/10/06/1","https://github.com/apache/httpcomponents-client/commit/51cc67567765d67f878f0dcef61b5ded454d3122","https://security.netapp.com/advisory/ntap-20231027-0003","https://svn.apache.org/viewvc?view=revision&revision=1614064"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cfh5-3ghh-wfjx","description":"Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2014-3577","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-3577","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-3577","date":"2026-10-10","epss":0.09189,"percentile":0.95224}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html","http://rhn.redhat.com/errata/RHSA-2014-1146.html","http://rhn.redhat.com/errata/RHSA-2014-1166.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1176.html","http://rhn.redhat.com/errata/RHSA-2015-1177.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://rhn.redhat.com/errata/RHSA-2016-1931.html","http://seclists.org/fulldisclosure/2014/Aug/48","http://secunia.com/advisories/60466","http://secunia.com/advisories/60589","http://secunia.com/advisories/60713","http://www.openwall.com/lists/oss-security/2021/10/06/1","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.osvdb.org/110143","http://www.securityfocus.com/bid/69258","http://www.securitytracker.com/id/1030812","http://www.ubuntu.com/usn/USN-2769-1","https://access.redhat.com/solutions/1165533","https://exchange.xforce.ibmcloud.com/vulnerabilities/95327","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E","https://security.netapp.com/advisory/ntap-20231027-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-3577","description":"org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a \"CN=\" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the \"foo,CN=www.apache.org\" string in the O field."}]},{"artifact":{"id":"48b65df626e72234","cpes":["cpe:2.3:a:apache:httpclient:4.3.2:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.3.2","type":"java-archive","version":"4.3.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-httpclient-plugin-0.21.4.jar:org.apache.httpcomponents:httpclient","manifestName":"","pomArtifactID":"httpclient","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-httpclient-plugin-0.21.4.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.3.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cfh5-3ghh-wfjx","versionConstraint":"<4.3.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cfh5-3ghh-wfjx","fix":{"state":"fixed","versions":["4.3.5"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.3.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-3577","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-3577","date":"2026-10-10","epss":0.09189,"percentile":0.95224}],"risk":4.5945,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2014-3577","https://access.redhat.com/solutions/1165533","https://exchange.xforce.ibmcloud.com/vulnerabilities/95327","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e@%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4@%3Ccommits.cxf.apache.org%3E","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html","http://rhn.redhat.com/errata/RHSA-2014-1146.html","http://rhn.redhat.com/errata/RHSA-2014-1166.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1176.html","http://rhn.redhat.com/errata/RHSA-2015-1177.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://rhn.redhat.com/errata/RHSA-2016-1931.html","http://seclists.org/fulldisclosure/2014/Aug/48","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.ubuntu.com/usn/USN-2769-1","http://www.openwall.com/lists/oss-security/2021/10/06/1","https://github.com/apache/httpcomponents-client/commit/51cc67567765d67f878f0dcef61b5ded454d3122","https://security.netapp.com/advisory/ntap-20231027-0003","https://svn.apache.org/viewvc?view=revision&revision=1614064"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cfh5-3ghh-wfjx","description":"Improper Verification of Cryptographic Signature in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2014-3577","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-3577","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-3577","date":"2026-10-10","epss":0.09189,"percentile":0.95224}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00033.html","http://packetstormsecurity.com/files/127913/Apache-HttpComponents-Man-In-The-Middle.html","http://rhn.redhat.com/errata/RHSA-2014-1146.html","http://rhn.redhat.com/errata/RHSA-2014-1166.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1176.html","http://rhn.redhat.com/errata/RHSA-2015-1177.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://rhn.redhat.com/errata/RHSA-2016-1773.html","http://rhn.redhat.com/errata/RHSA-2016-1931.html","http://seclists.org/fulldisclosure/2014/Aug/48","http://secunia.com/advisories/60466","http://secunia.com/advisories/60589","http://secunia.com/advisories/60713","http://www.openwall.com/lists/oss-security/2021/10/06/1","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.osvdb.org/110143","http://www.securityfocus.com/bid/69258","http://www.securitytracker.com/id/1030812","http://www.ubuntu.com/usn/USN-2769-1","https://access.redhat.com/solutions/1165533","https://exchange.xforce.ibmcloud.com/vulnerabilities/95327","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05363782","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E","https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E","https://security.netapp.com/advisory/ntap-20231027-0003/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-3577","description":"org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a \"CN=\" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the \"foo,CN=www.apache.org\" string in the O field."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000122","versionConstraint":"< 7.38.0-4+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000122","fix":{"state":"fixed","versions":["7.38.0-4+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-10","epss":0.09039,"percentile":0.95175}],"risk":4.5195,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4136-1","link":"https://security-tracker.debian.org/tracker/DSA-4136-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000122"},"relatedVulnerabilities":[{"id":"CVE-2018-1000122","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-10","epss":0.09039,"percentile":0.95175}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103436","http://www.securitytracker.com/id/1040530","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b047.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000122","description":"A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage"}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000122","versionConstraint":"< 7.38.0-4+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000122","fix":{"state":"fixed","versions":["7.38.0-4+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-10","epss":0.09039,"percentile":0.95175}],"risk":4.5195,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4136-1","link":"https://security-tracker.debian.org/tracker/DSA-4136-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000122"},"relatedVulnerabilities":[{"id":"CVE-2018-1000122","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-10","epss":0.09039,"percentile":0.95175}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103436","http://www.securitytracker.com/id/1040530","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b047.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000122","description":"A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage"}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000122","versionConstraint":"< 7.38.0-4+deb8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000122","fix":{"state":"fixed","versions":["7.38.0-4+deb8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u10"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-10","epss":0.09039,"percentile":0.95175}],"risk":4.5195,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4136-1","link":"https://security-tracker.debian.org/tracker/DSA-4136-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000122"},"relatedVulnerabilities":[{"id":"CVE-2018-1000122","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-10","epss":0.09039,"percentile":0.95175}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103436","http://www.securitytracker.com/id/1040530","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b047.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000122","description":"A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage"}]},{"artifact":{"id":"c785efba1000c46e","cpes":["cpe:2.3:a:libprocps3:libprocps3:2\\:3.3.9-9:*:*:*:*:*:*:*"],"name":"libprocps3","purl":"pkg:deb/debian/libprocps3@2%3A3.3.9-9?arch=amd64&distro=debian-8.5&upstream=procps","type":"deb","version":"2:3.3.9-9","language":"","licenses":["sha256:030b4251d06b344fa561a6c54a861d9600984b7464bcdeeed72cafcbae9ce73c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libprocps3/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libprocps3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libprocps3:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libprocps3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"procps"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.3.9-9+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1123","versionConstraint":"< 2:3.3.9-9+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"procps","version":"2:3.3.9-9"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1123","fix":{"state":"fixed","versions":["2:3.3.9-9+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.3.9-9+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-10-10","epss":0.08902,"percentile":0.95122}],"risk":4.4510000000000005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4208-1","link":"https://security-tracker.debian.org/tracker/DSA-4208-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1123"},"relatedVulnerabilities":[{"id":"CVE-2018-1123","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-10-10","epss":0.08902,"percentile":0.95122}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html","http://seclists.org/oss-sec/2018/q2/122","http://www.securityfocus.com/bid/104214","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html","https://security.gentoo.org/glsa/201805-14","https://usn.ubuntu.com/3658-1/","https://usn.ubuntu.com/3658-3/","https://www.debian.org/security/2018/dsa-4208","https://www.exploit-db.com/exploits/44806/","https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1123","description":"procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service)."}]},{"artifact":{"id":"de8e877fa8628b52","cpes":["cpe:2.3:a:procps:procps:2\\:3.3.9-9:*:*:*:*:*:*:*"],"name":"procps","purl":"pkg:deb/debian/procps@2%3A3.3.9-9?arch=amd64&distro=debian-8.5","type":"deb","version":"2:3.3.9-9","language":"","licenses":["sha256:030b4251d06b344fa561a6c54a861d9600984b7464bcdeeed72cafcbae9ce73c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/procps/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/procps/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/procps.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/procps.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/procps.list"},{"path":"/var/lib/dpkg/info/procps.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/procps.postinst"},{"path":"/var/lib/dpkg/info/procps.postrm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/procps.postrm"},{"path":"/var/lib/dpkg/info/procps.preinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/procps.preinst"},{"path":"/var/lib/dpkg/info/procps.prerm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/procps.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.3.9-9+deb8u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1123","versionConstraint":"< 2:3.3.9-9+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"procps","version":"2:3.3.9-9"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1123","fix":{"state":"fixed","versions":["2:3.3.9-9+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.3.9-9+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-10-10","epss":0.08902,"percentile":0.95122}],"risk":4.4510000000000005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4208-1","link":"https://security-tracker.debian.org/tracker/DSA-4208-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1123"},"relatedVulnerabilities":[{"id":"CVE-2018-1123","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-10-10","epss":0.08902,"percentile":0.95122}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html","http://seclists.org/oss-sec/2018/q2/122","http://www.securityfocus.com/bid/104214","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html","https://security.gentoo.org/glsa/201805-14","https://usn.ubuntu.com/3658-1/","https://usn.ubuntu.com/3658-3/","https://www.debian.org/security/2018/dsa-4208","https://www.exploit-db.com/exploits/44806/","https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1123","description":"procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service)."}]},{"artifact":{"id":"21b92dc066fc64ca","cpes":["cpe:2.3:a:librtmp1:librtmp1:2.4\\+20150115.gita107cef-1:*:*:*:*:*:*:*"],"name":"librtmp1","purl":"pkg:deb/debian/librtmp1@2.4%2B20150115.gita107cef-1?arch=amd64&distro=debian-8.5&upstream=rtmpdump","type":"deb","version":"2.4+20150115.gita107cef-1","language":"","licenses":["sha256:4302abcc1ea1b6cbe8d19c79b892acf78878030220210707c19006828866207c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/librtmp1/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/librtmp1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/librtmp1:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/librtmp1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"rtmpdump"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4+20150115.gita107cef-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-8271","versionConstraint":"< 2.4+20150115.gita107cef-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"rtmpdump","version":"2.4+20150115.gita107cef-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-8271","fix":{"state":"fixed","versions":["2.4+20150115.gita107cef-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4+20150115.gita107cef-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-8271","cwe":"CWE-123","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-8271","date":"2026-10-10","epss":0.05923,"percentile":0.93077}],"risk":4.44225,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3850-1","link":"https://security-tracker.debian.org/tracker/DSA-3850-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-8271"},"relatedVulnerabilities":[{"id":"CVE-2015-8271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-8271","cwe":"CWE-123","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-8271","date":"2026-10-10","epss":0.05923,"percentile":0.93077}],"urls":["http://www.debian.org/security/2017/dsa-3850","http://www.securityfocus.com/bid/95125","http://www.talosintelligence.com/reports/TALOS-2016-0067/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-8271","description":"The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code."}]},{"artifact":{"id":"7eaafe3de0d9d3c6","cpes":["cpe:2.3:a:wget:wget:1.16-1:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/debian/wget@1.16-1?arch=amd64&distro=debian-8.5","type":"deb","version":"1.16-1","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16-1+deb8u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-5953","versionConstraint":"< 1.16-1+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"wget","version":"1.16-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-5953","fix":{"state":"fixed","versions":["1.16-1+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.16-1+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-5953","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5953","date":"2026-10-10","epss":0.05862,"percentile":0.93027}],"risk":4.3965,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-5953"},"relatedVulnerabilities":[{"id":"CVE-2019-5953","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5953","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5953","date":"2026-10-10","epss":0.05862,"percentile":0.93027}],"urls":["http://jvn.jp/en/jp/JVN25261088/index.html","https://access.redhat.com/errata/RHSA-2019:2979","https://access.redhat.com/errata/RHSA-2019:3168","https://security.gentoo.org/glsa/201908-19","https://support.f5.com/csp/article/K14560101","https://www.gnu.org/software/wget/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5953","description":"Buffer overflow in GNU Wget 1.20.1 and earlier allows remote attackers to cause a denial-of-service (DoS) or may execute an arbitrary code via unspecified vectors."}]},{"artifact":{"id":"4a6fc25b02170f2a","cpes":["cpe:2.3:a:apache:httpclient:4.0:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.0","type":"java-archive","version":"4.0","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:httpclient-osgi-4.0.jar:httpclient-4.0.jar","manifestName":"","pomArtifactID":"httpclient","archiveDigests":[{"value":"a76d7fd8033d48b4c67b4ccf159abb080c1059b6","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:httpclient-osgi-4.0.jar:httpclient-4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2x83-r56g-cv47","versionConstraint":"<4.2.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2x83-r56g-cv47","fix":{"state":"fixed","versions":["4.2.3"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.2.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2012-6153","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-6153","date":"2026-10-10","epss":0.05844,"percentile":0.93003}],"risk":4.383,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2012-6153","https://access.redhat.com/solutions/1165533","https://bugzilla.redhat.com/show_bug.cgi?id=1129916","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564","http://rhn.redhat.com/errata/RHSA-2014-1098.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://svn.apache.org/viewvc?view=revision&revision=1411705","http://www.ubuntu.com/usn/USN-2769-1","https://github.com/apache/httpcomponents-client/commit/6e14fc146a66e0f3eb362f45f95d1a58ee18886a","https://github.com/apache/httpcomponents-client/commit/b930227f907af1198765fc47beabbddae344ca7b"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2x83-r56g-cv47","description":"Improper certificate validation in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2012-6153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-6153","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-6153","date":"2026-10-10","epss":0.05844,"percentile":0.93003}],"urls":["http://rhn.redhat.com/errata/RHSA-2014-1098.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://svn.apache.org/viewvc?view=revision&revision=1411705","http://www.securityfocus.com/bid/69257","http://www.ubuntu.com/usn/USN-2769-1","https://access.redhat.com/solutions/1165533","https://bugzilla.redhat.com/show_bug.cgi?id=1129916","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-6153","description":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5783."}]},{"artifact":{"id":"9bdc2593baa750a4","cpes":["cpe:2.3:a:apache:httpclient:4.2:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.2","type":"java-archive","version":"4.2","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:org.apache.httpcomponents:httpclient","manifestName":"","pomArtifactID":"httpclient","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.2.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2x83-r56g-cv47","versionConstraint":"<4.2.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2x83-r56g-cv47","fix":{"state":"fixed","versions":["4.2.3"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"4.2.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2012-6153","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-6153","date":"2026-10-10","epss":0.05844,"percentile":0.93003}],"risk":4.383,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2012-6153","https://access.redhat.com/solutions/1165533","https://bugzilla.redhat.com/show_bug.cgi?id=1129916","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564","http://rhn.redhat.com/errata/RHSA-2014-1098.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://svn.apache.org/viewvc?view=revision&revision=1411705","http://www.ubuntu.com/usn/USN-2769-1","https://github.com/apache/httpcomponents-client/commit/6e14fc146a66e0f3eb362f45f95d1a58ee18886a","https://github.com/apache/httpcomponents-client/commit/b930227f907af1198765fc47beabbddae344ca7b"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2x83-r56g-cv47","description":"Improper certificate validation in org.apache.httpcomponents:httpclient"},"relatedVulnerabilities":[{"id":"CVE-2012-6153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-6153","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-6153","date":"2026-10-10","epss":0.05844,"percentile":0.93003}],"urls":["http://rhn.redhat.com/errata/RHSA-2014-1098.html","http://rhn.redhat.com/errata/RHSA-2014-1833.html","http://rhn.redhat.com/errata/RHSA-2014-1834.html","http://rhn.redhat.com/errata/RHSA-2014-1835.html","http://rhn.redhat.com/errata/RHSA-2014-1836.html","http://rhn.redhat.com/errata/RHSA-2014-1891.html","http://rhn.redhat.com/errata/RHSA-2014-1892.html","http://rhn.redhat.com/errata/RHSA-2015-0125.html","http://rhn.redhat.com/errata/RHSA-2015-0158.html","http://rhn.redhat.com/errata/RHSA-2015-0675.html","http://rhn.redhat.com/errata/RHSA-2015-0720.html","http://rhn.redhat.com/errata/RHSA-2015-0765.html","http://rhn.redhat.com/errata/RHSA-2015-0850.html","http://rhn.redhat.com/errata/RHSA-2015-0851.html","http://rhn.redhat.com/errata/RHSA-2015-1888.html","http://svn.apache.org/viewvc?view=revision&revision=1411705","http://www.securityfocus.com/bid/69257","http://www.ubuntu.com/usn/USN-2769-1","https://access.redhat.com/solutions/1165533","https://bugzilla.redhat.com/show_bug.cgi?id=1129916","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05103564"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-6153","description":"http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5783."}]},{"artifact":{"id":"5edbbe9f0eaac947","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-6\\+deb8u3:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.1.0-6%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=expat","type":"deb","version":"2.1.0-6+deb8u3","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0-6+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-9233","versionConstraint":"< 2.1.0-6+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"expat","version":"2.1.0-6+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9233","fix":{"state":"fixed","versions":["2.1.0-6+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.0-6+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-9233","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-9233","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9233","date":"2026-10-10","epss":0.08739,"percentile":0.95043}],"risk":4.3694999999999995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3898-1","link":"https://security-tracker.debian.org/tracker/DSA-3898-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9233"},"relatedVulnerabilities":[{"id":"CVE-2017-9233","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9233","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-9233","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9233","date":"2026-10-10","epss":0.08739,"percentile":0.95043}],"urls":["http://www.debian.org/security/2017/dsa-3898","http://www.openwall.com/lists/oss-security/2017/06/17/7","http://www.securityfocus.com/bid/99276","http://www.securitytracker.com/id/1039427","https://github.com/libexpat/libexpat/blob/master/expat/Changes","https://libexpat.github.io/doc/cve-2017-9233/","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://support.f5.com/csp/article/K03244804"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9233","description":"XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.8.11.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f3j5-rmmp-3fc5","versionConstraint":"<2.8.11.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f3j5-rmmp-3fc5","fix":{"state":"fixed","versions":["2.8.11.5"],"available":[{"date":"2023-09-14","kind":"first-observed","version":"2.8.11.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17267","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17267","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-17267","date":"2026-10-10","epss":0.04628,"percentile":0.91484}],"risk":4.350320000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-17267","https://github.com/FasterXML/jackson-databind/issues/2460","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.3...jackson-databind-2.9.10","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r9d727fc681fb3828794acbefcaee31393742b4d73a29461ccd9597a8@%3Cdev.skywalking.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html","https://security.netapp.com/advisory/ntap-20191017-0006/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/191a4cdf87b56d2ddddb77edd895ee756b7f75eb"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f3j5-rmmp-3fc5","description":"Improper Input Validation in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-17267","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17267","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17267","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-17267","date":"2026-10-10","epss":0.04628,"percentile":0.91484}],"urls":["https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.3...jackson-databind-2.9.10","https://github.com/FasterXML/jackson-databind/issues/2460","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r9d727fc681fb3828794acbefcaee31393742b4d73a29461ccd9597a8%40%3Cdev.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html","https://security.netapp.com/advisory/ntap-20191017-0006/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17267","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.8.11.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-f3j5-rmmp-3fc5","versionConstraint":"<2.8.11.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-f3j5-rmmp-3fc5","fix":{"state":"fixed","versions":["2.8.11.5"],"available":[{"date":"2023-09-14","kind":"first-observed","version":"2.8.11.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17267","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17267","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-17267","date":"2026-10-10","epss":0.04628,"percentile":0.91484}],"risk":4.350320000000001,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-17267","https://github.com/FasterXML/jackson-databind/issues/2460","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.3...jackson-databind-2.9.10","https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f@%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r9d727fc681fb3828794acbefcaee31393742b4d73a29461ccd9597a8@%3Cdev.skywalking.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html","https://security.netapp.com/advisory/ntap-20191017-0006/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2020.html","https://github.com/FasterXML/jackson-databind/commit/191a4cdf87b56d2ddddb77edd895ee756b7f75eb"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-f3j5-rmmp-3fc5","description":"Improper Input Validation in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-17267","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17267","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17267","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-17267","date":"2026-10-10","epss":0.04628,"percentile":0.91484}],"urls":["https://access.redhat.com/errata/RHSA-2019:3200","https://access.redhat.com/errata/RHSA-2020:0159","https://access.redhat.com/errata/RHSA-2020:0160","https://access.redhat.com/errata/RHSA-2020:0161","https://access.redhat.com/errata/RHSA-2020:0164","https://access.redhat.com/errata/RHSA-2020:0445","https://github.com/FasterXML/jackson-databind/compare/jackson-databind-2.9.9.3...jackson-databind-2.9.10","https://github.com/FasterXML/jackson-databind/issues/2460","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r392099ed2757ff2e383b10440594e914d080511d7da1c8fed0612c1f%40%3Ccommits.druid.apache.org%3E","https://lists.apache.org/thread.html/r9d727fc681fb3828794acbefcaee31393742b4d73a29461ccd9597a8%40%3Cdev.skywalking.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00013.html","https://security.netapp.com/advisory/ntap-20191017-0006/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17267","description":"A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup."}]},{"artifact":{"id":"796f2a2a2aa72b2c","cpes":["cpe:2.3:a:libicu52:libicu52:52.1-8\\+deb8u3:*:*:*:*:*:*:*"],"name":"libicu52","purl":"pkg:deb/debian/libicu52@52.1-8%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=icu","type":"deb","version":"52.1-8+deb8u3","language":"","licenses":["sha256:d1fcfd4dec63109efa1c8e00748a9bf2cb1d1682bb7fc281c9509efc26e3d487"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libicu52/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libicu52/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libicu52:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libicu52:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"icu"}]},"matchDetails":[{"fix":{"suggestedVersion":"52.1-8+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7415","versionConstraint":"< 52.1-8+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"icu","version":"52.1-8+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7415","fix":{"state":"fixed","versions":["52.1-8+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"52.1-8+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7415","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7415","date":"2026-10-10","epss":0.05798,"percentile":0.92946}],"risk":4.3485,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3725-1","link":"https://security-tracker.debian.org/tracker/DSA-3725-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7415"},"relatedVulnerabilities":[{"id":"CVE-2016-7415","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7415","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7415","date":"2026-10-10","epss":0.05798,"percentile":0.92946}],"urls":["http://www.openwall.com/lists/oss-security/2016/09/15/10","http://www.securityfocus.com/bid/93022","https://bugs.php.net/bug.php?id=73007","https://security.gentoo.org/glsa/201701-58","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.tenable.com/security/tns-2016-19"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7415","description":"Stack-based buffer overflow in the Locale class in common/locid.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long locale string."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-16839","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16839","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-10","epss":0.05782,"percentile":0.92918}],"risk":4.3365,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16839"},"relatedVulnerabilities":[{"id":"CVE-2018-16839","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-10","epss":0.05782,"percentile":0.92918}],"urls":["http://www.securitytracker.com/id/1042012","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16839","https://curl.haxx.se/docs/CVE-2018-16839.html","https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3805-1/","https://www.debian.org/security/2018/dsa-4331"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16839","description":"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16839","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16839","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-10","epss":0.05782,"percentile":0.92918}],"risk":4.3365,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16839"},"relatedVulnerabilities":[{"id":"CVE-2018-16839","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-10","epss":0.05782,"percentile":0.92918}],"urls":["http://www.securitytracker.com/id/1042012","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16839","https://curl.haxx.se/docs/CVE-2018-16839.html","https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3805-1/","https://www.debian.org/security/2018/dsa-4331"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16839","description":"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16839","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16839","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-10","epss":0.05782,"percentile":0.92918}],"risk":4.3365,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16839"},"relatedVulnerabilities":[{"id":"CVE-2018-16839","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-10","epss":0.05782,"percentile":0.92918}],"urls":["http://www.securitytracker.com/id/1042012","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16839","https://curl.haxx.se/docs/CVE-2018-16839.html","https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3805-1/","https://www.debian.org/security/2018/dsa-4331"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16839","description":"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service."}]},{"artifact":{"id":"2d59f7478c0a2886","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.5&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9843","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9843","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-9843","date":"2026-10-10","epss":0.05766,"percentile":0.92904}],"risk":4.3245000000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9843"},"relatedVulnerabilities":[{"id":"CVE-2016-9843","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-9843","date":"2026-10-10","epss":0.05766,"percentile":0.92904}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","http://www.securitytracker.com/id/1041888","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402351","https://github.com/madler/zlib/commit/d1d577490c15a0c6862473d7576352a9f18ef811","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://security.netapp.com/advisory/ntap-20181018-0002/","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9843","description":"The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation."}]},{"artifact":{"id":"3eb92f7ec39e3872","cpes":["cpe:2.3:a:org.springframework:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring-webmvc:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring_webmvc:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-webmvc:2.5.6.SEC03:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_webmvc:2.5.6.SEC03:*:*:*:*:*:*:*"],"name":"spring-webmvc","purl":"pkg:maven/org.springframework/spring-webmvc@2.5.6.SEC03","type":"java-archive","version":"2.5.6.SEC03","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:embedded-crowd-admin-plugin-1.8.4.jar:META-INF/lib/spring-webmvc-2.5.6.SEC03.jar","manifestName":"","pomArtifactID":"spring-webmvc","archiveDigests":[{"value":"275c5ac6ade12819f49e984c8e06b114a4e23458","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:embedded-crowd-admin-plugin-1.8.4.jar:META-INF/lib/spring-webmvc-2.5.6.SEC03.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.2.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-2m8h-fgr8-2q9w","versionConstraint":"<3.2.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-webmvc","version":"2.5.6.SEC03"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-2m8h-fgr8-2q9w","fix":{"state":"fixed","versions":["3.2.18"],"available":[{"date":"2023-09-26","kind":"first-observed","version":"3.2.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9878","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9878","date":"2026-10-10","epss":0.05748,"percentile":0.92888}],"risk":4.311,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-9878","https://access.redhat.com/errata/RHSA-2017:3115","https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html","https://pivotal.io/security/cve-2016-9878","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/95072","http://www.securitytracker.com/id/1040698","https://github.com/spring-projects/spring-framework/issues/19513","https://github.com/spring-projects/spring-framework/commit/43bf008fbcd0d7945e2fcd5e30039bc4d74c7a98","https://github.com/spring-projects/spring-framework/commit/a7dc48534ea501525f11369d369178a60c2f47d0","https://github.com/spring-projects/spring-framework/commit/e2d6e709c3c65a4951eb096843ee75d5200cfcad","https://security.netapp.com/advisory/ntap-20180419-0002"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-2m8h-fgr8-2q9w","description":"Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized"},"relatedVulnerabilities":[{"id":"CVE-2016-9878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9878","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9878","date":"2026-10-10","epss":0.05748,"percentile":0.92888}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/95072","http://www.securitytracker.com/id/1040698","https://access.redhat.com/errata/RHSA-2017:3115","https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html","https://pivotal.io/security/cve-2016-9878","https://security.netapp.com/advisory/ntap-20180419-0002/","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9878","description":"An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks."}]},{"artifact":{"id":"08598e55e147d059","cpes":["cpe:2.3:a:gnupg:gnupg:1.4.18-7\\+deb8u1:*:*:*:*:*:*:*"],"name":"gnupg","purl":"pkg:deb/debian/gnupg@1.4.18-7%2Bdeb8u1?arch=amd64&distro=debian-8.5","type":"deb","version":"1.4.18-7+deb8u1","language":"","licenses":["GPL-3","GPL-3+","RFC-Reference"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/gnupg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/gnupg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/gnupg.list"},{"path":"/var/lib/dpkg/info/gnupg.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/gnupg.postinst"},{"path":"/var/lib/dpkg/info/gnupg.preinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/gnupg.preinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.18-7+deb8u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-12020","versionConstraint":"< 1.4.18-7+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"gnupg","version":"1.4.18-7+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12020","fix":{"state":"fixed","versions":["1.4.18-7+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.18-7+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-10-10","epss":0.08546,"percentile":0.94946}],"risk":4.273,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4224-1","link":"https://security-tracker.debian.org/tracker/DSA-4224-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12020"},"relatedVulnerabilities":[{"id":"CVE-2018-12020","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-10-10","epss":0.08546,"percentile":0.94946}],"urls":["http://openwall.com/lists/oss-security/2018/06/08/2","http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html","http://seclists.org/fulldisclosure/2019/Apr/38","http://www.openwall.com/lists/oss-security/2019/04/30/4","http://www.securityfocus.com/bid/104450","http://www.securitytracker.com/id/1041051","https://access.redhat.com/errata/RHSA-2018:2180","https://access.redhat.com/errata/RHSA-2018:2181","https://dev.gnupg.org/T4012","https://github.com/RUB-NDS/Johnny-You-Are-Fired","https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html","https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html","https://usn.ubuntu.com/3675-1/","https://usn.ubuntu.com/3675-2/","https://usn.ubuntu.com/3675-3/","https://usn.ubuntu.com/3964-1/","https://www.debian.org/security/2018/dsa-4222","https://www.debian.org/security/2018/dsa-4223","https://www.debian.org/security/2018/dsa-4224"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes."}]},{"artifact":{"id":"193550916c2633d2","cpes":["cpe:2.3:a:gpgv:gpgv:1.4.18-7\\+deb8u1:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/debian/gpgv@1.4.18-7%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=gnupg","type":"deb","version":"1.4.18-7+deb8u1","language":"","licenses":["GPL-3","GPL-3+","RFC-Reference"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.18-7+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12020","versionConstraint":"< 1.4.18-7+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"gnupg","version":"1.4.18-7+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12020","fix":{"state":"fixed","versions":["1.4.18-7+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.18-7+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-10-10","epss":0.08546,"percentile":0.94946}],"risk":4.273,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4224-1","link":"https://security-tracker.debian.org/tracker/DSA-4224-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12020"},"relatedVulnerabilities":[{"id":"CVE-2018-12020","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-10-10","epss":0.08546,"percentile":0.94946}],"urls":["http://openwall.com/lists/oss-security/2018/06/08/2","http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html","http://seclists.org/fulldisclosure/2019/Apr/38","http://www.openwall.com/lists/oss-security/2019/04/30/4","http://www.securityfocus.com/bid/104450","http://www.securitytracker.com/id/1041051","https://access.redhat.com/errata/RHSA-2018:2180","https://access.redhat.com/errata/RHSA-2018:2181","https://dev.gnupg.org/T4012","https://github.com/RUB-NDS/Johnny-You-Are-Fired","https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html","https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html","https://usn.ubuntu.com/3675-1/","https://usn.ubuntu.com/3675-2/","https://usn.ubuntu.com/3675-3/","https://usn.ubuntu.com/3964-1/","https://www.debian.org/security/2018/dsa-4222","https://www.debian.org/security/2018/dsa-4223","https://www.debian.org/security/2018/dsa-4224"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes."}]},{"artifact":{"id":"c925ed409bd5a113","cpes":["cpe:2.3:a:org.springframework:spring-context:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_context:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-context:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_context:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-context:spring-context:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-context:spring_context:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_context:spring-context:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_context:spring_context:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-context:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_context:4.1.6.RELEASE:*:*:*:*:*:*:*"],"name":"spring-context","purl":"pkg:maven/org.springframework/spring-context@4.1.6.RELEASE","type":"java-archive","version":"4.1.6.RELEASE","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-context-4.1.6.RELEASE.jar","manifestName":"","pomArtifactID":"spring-context","archiveDigests":[{"value":"15f0b22bf89ed468badbc4eec759af2b916d33e4","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-context-4.1.6.RELEASE.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-context-4.1.6.RELEASE.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.2.21.RELEASE"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-g5mm-vmx4-3rg7","versionConstraint":"<5.2.21.RELEASE (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-context","version":"4.1.6.RELEASE"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-g5mm-vmx4-3rg7","fix":{"state":"fixed","versions":["5.2.21.RELEASE"],"available":[{"date":"2024-05-16","kind":"first-observed","version":"5.2.21.RELEASE"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22968","cwe":"CWE-178","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22968","date":"2026-10-10","epss":0.05666,"percentile":0.92796}],"risk":4.2495,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-22968","https://tanzu.vmware.com/security/cve-2022-22968","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/spring-projects/spring-framework/commit/833e750175349ab4fd502109a8b41af77e25cdea","https://github.com/spring-projects/spring-framework/commit/a7cf19cec5ebd270f97a194d749e2d5701ad2ab7","https://security.netapp.com/advisory/ntap-20220602-0004"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-g5mm-vmx4-3rg7","description":"Improper handling of case sensitivity in Spring Framework"},"relatedVulnerabilities":[{"id":"CVE-2022-22968","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-22968","cwe":"CWE-178","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-22968","date":"2026-10-10","epss":0.05666,"percentile":0.92796}],"urls":["https://security.netapp.com/advisory/ntap-20220602-0004/","https://tanzu.vmware.com/security/cve-2022-22968","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-22968","description":"In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-1000254","versionConstraint":"< 7.38.0-4+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000254","fix":{"state":"fixed","versions":["7.38.0-4+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-10","epss":0.08465,"percentile":0.949}],"risk":4.2325,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3992-1","link":"https://security-tracker.debian.org/tracker/DSA-3992-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000254"},"relatedVulnerabilities":[{"id":"CVE-2017-1000254","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-10","epss":0.08465,"percentile":0.949}],"urls":["http://www.debian.org/security/2017/dsa-3992","http://www.securityfocus.com/bid/101115","http://www.securitytracker.com/id/1039509","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/673d0cd8.patch","https://curl.haxx.se/docs/adv_20171004.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201712-04","https://support.apple.com/HT208331"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000254","description":"libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000254","versionConstraint":"< 7.38.0-4+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000254","fix":{"state":"fixed","versions":["7.38.0-4+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-10","epss":0.08465,"percentile":0.949}],"risk":4.2325,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3992-1","link":"https://security-tracker.debian.org/tracker/DSA-3992-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000254"},"relatedVulnerabilities":[{"id":"CVE-2017-1000254","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-10","epss":0.08465,"percentile":0.949}],"urls":["http://www.debian.org/security/2017/dsa-3992","http://www.securityfocus.com/bid/101115","http://www.securitytracker.com/id/1039509","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/673d0cd8.patch","https://curl.haxx.se/docs/adv_20171004.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201712-04","https://support.apple.com/HT208331"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000254","description":"libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000254","versionConstraint":"< 7.38.0-4+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000254","fix":{"state":"fixed","versions":["7.38.0-4+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-10","epss":0.08465,"percentile":0.949}],"risk":4.2325,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3992-1","link":"https://security-tracker.debian.org/tracker/DSA-3992-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000254"},"relatedVulnerabilities":[{"id":"CVE-2017-1000254","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-10","epss":0.08465,"percentile":0.949}],"urls":["http://www.debian.org/security/2017/dsa-3992","http://www.securityfocus.com/bid/101115","http://www.securitytracker.com/id/1039509","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/673d0cd8.patch","https://curl.haxx.se/docs/adv_20171004.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201712-04","https://support.apple.com/HT208331"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000254","description":"libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cf6r-3wgc-h863","versionConstraint":"<=2.6.7.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cf6r-3wgc-h863","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2021-03-30","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14892","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-14892","cwe":"CWE-502","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-14892","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14892","date":"2026-10-10","epss":0.05622,"percentile":0.92758}],"risk":4.2165,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-14892","https://github.com/FasterXML/jackson-databind/issues/2462","https://github.com/FasterXML/jackson-databind/commit/41b7f9b90149e9d44a65a8261a8deedc7186f6af","https://github.com/FasterXML/jackson-databind/commit/819cdbcab51c6da9fb896380f2d46e9b7d4fdc3b","https://access.redhat.com/errata/RHSA-2020:0729","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://security.netapp.com/advisory/ntap-20200904-0005/"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cf6r-3wgc-h863","description":"Polymorphic deserialization of malicious object in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-14892","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14892","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-14892","cwe":"CWE-502","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-14892","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14892","date":"2026-10-10","epss":0.05622,"percentile":0.92758}],"urls":["https://access.redhat.com/errata/RHSA-2020:0729","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892","https://github.com/FasterXML/jackson-databind/issues/2462","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://security.netapp.com/advisory/ntap-20200904-0005/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14892","description":"A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cf6r-3wgc-h863","versionConstraint":"<=2.6.7.2 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cf6r-3wgc-h863","fix":{"state":"fixed","versions":["2.6.7.3"],"available":[{"date":"2021-03-30","kind":"first-observed","version":"2.6.7.3"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14892","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-14892","cwe":"CWE-502","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-14892","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14892","date":"2026-10-10","epss":0.05622,"percentile":0.92758}],"risk":4.2165,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-14892","https://github.com/FasterXML/jackson-databind/issues/2462","https://github.com/FasterXML/jackson-databind/commit/41b7f9b90149e9d44a65a8261a8deedc7186f6af","https://github.com/FasterXML/jackson-databind/commit/819cdbcab51c6da9fb896380f2d46e9b7d4fdc3b","https://access.redhat.com/errata/RHSA-2020:0729","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E","https://security.netapp.com/advisory/ntap-20200904-0005/"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cf6r-3wgc-h863","description":"Polymorphic deserialization of malicious object in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2019-14892","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14892","cwe":"CWE-200","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-14892","cwe":"CWE-502","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-14892","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14892","date":"2026-10-10","epss":0.05622,"percentile":0.92758}],"urls":["https://access.redhat.com/errata/RHSA-2020:0729","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892","https://github.com/FasterXML/jackson-databind/issues/2462","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E","https://security.netapp.com/advisory/ntap-20200904-0005/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14892","description":"A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code."}]},{"artifact":{"id":"796f2a2a2aa72b2c","cpes":["cpe:2.3:a:libicu52:libicu52:52.1-8\\+deb8u3:*:*:*:*:*:*:*"],"name":"libicu52","purl":"pkg:deb/debian/libicu52@52.1-8%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=icu","type":"deb","version":"52.1-8+deb8u3","language":"","licenses":["sha256:d1fcfd4dec63109efa1c8e00748a9bf2cb1d1682bb7fc281c9509efc26e3d487"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libicu52/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libicu52/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libicu52:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libicu52:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"icu"}]},"matchDetails":[{"fix":{"suggestedVersion":"52.1-8+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9911","versionConstraint":"< 52.1-8+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"icu","version":"52.1-8+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9911","fix":{"state":"fixed","versions":["52.1-8+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"52.1-8+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2014-9911","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9911","date":"2026-10-10","epss":0.05563,"percentile":0.92671}],"risk":4.17225,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3725-1","link":"https://security-tracker.debian.org/tracker/DSA-3725-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9911"},"relatedVulnerabilities":[{"id":"CVE-2014-9911","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9911","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9911","date":"2026-10-10","epss":0.05563,"percentile":0.92671}],"urls":["http://bugs.icu-project.org/trac/changeset/35699","http://bugs.icu-project.org/trac/ticket/1089","http://www.openwall.com/lists/oss-security/2016/11/25/1","http://www.securityfocus.com/bid/94520","http://www.securitytracker.com/id/1037556","https://bugs.php.net/bug.php?id=67397","https://bugzilla.redhat.com/show_bug.cgi?id=1383569","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9911","description":"Stack-based buffer overflow in the ures_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) before 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call."}]},{"artifact":{"id":"d91ce551dcf6c33f","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-10","epss":0.05506,"percentile":0.92604}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-10","epss":0.05506,"percentile":0.92604}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"495e1452a66e5099","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-10","epss":0.05506,"percentile":0.92604}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-10","epss":0.05506,"percentile":0.92604}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"6dec8d97d34362ed","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2014-9761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2014-9761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-10","epss":0.05506,"percentile":0.92604}],"risk":4.1295,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2014-9761"},"relatedVulnerabilities":[{"id":"CVE-2014-9761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2014-9761","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2014-9761","date":"2026-10-10","epss":0.05506,"percentile":0.92604}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.html","http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://rhn.redhat.com/errata/RHSA-2017-0680.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://www.openwall.com/lists/oss-security/2016/01/19/11","http://www.openwall.com/lists/oss-security/2016/01/20/1","http://www.securityfocus.com/bid/83306","http://www.ubuntu.com/usn/USN-2985-1","http://www.ubuntu.com/usn/USN-2985-2","https://access.redhat.com/errata/RHSA-2017:1916","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=16962","https://www.sourceware.org/ml/libc-alpha/2016-02/msg00502.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2014-9761","description":"Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function."}]},{"artifact":{"id":"5edbbe9f0eaac947","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-6\\+deb8u3:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.1.0-6%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=expat","type":"deb","version":"2.1.0-6+deb8u3","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0-6+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9063","versionConstraint":"< 2.1.0-6+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"expat","version":"2.1.0-6+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9063","fix":{"state":"fixed","versions":["2.1.0-6+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.0-6+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-9063","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9063","date":"2026-10-10","epss":0.05472,"percentile":0.92566}],"risk":4.104,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9063"},"relatedVulnerabilities":[{"id":"CVE-2016-9063","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9063","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9063","date":"2026-10-10","epss":0.05472,"percentile":0.92566}],"urls":["http://www.securityfocus.com/bid/94337","http://www.securitytracker.com/id/1037298","http://www.securitytracker.com/id/1039427","https://bugzilla.mozilla.org/show_bug.cgi?id=1274777","https://www.debian.org/security/2017/dsa-3898","https://www.mozilla.org/security/advisories/mfsa2016-89/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9063","description":"An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-7141","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7141","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7141","cwe":"CWE-287","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7141","date":"2026-10-10","epss":0.0818,"percentile":0.94745}],"risk":4.09,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7141"},"relatedVulnerabilities":[{"id":"CVE-2016-7141","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7141","cwe":"CWE-287","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7141","date":"2026-10-10","epss":0.0818,"percentile":0.94745}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92754","http://www.securitytracker.com/id/1036739","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=1373229","https://curl.haxx.se/docs/adv_20160907.html","https://github.com/curl/curl/commit/curl-7_50_2~32","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://security.gentoo.org/glsa/201701-47"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7141","description":"curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7141","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7141","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7141","cwe":"CWE-287","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7141","date":"2026-10-10","epss":0.0818,"percentile":0.94745}],"risk":4.09,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7141"},"relatedVulnerabilities":[{"id":"CVE-2016-7141","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7141","cwe":"CWE-287","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7141","date":"2026-10-10","epss":0.0818,"percentile":0.94745}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92754","http://www.securitytracker.com/id/1036739","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=1373229","https://curl.haxx.se/docs/adv_20160907.html","https://github.com/curl/curl/commit/curl-7_50_2~32","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://security.gentoo.org/glsa/201701-47"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7141","description":"curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7141","versionConstraint":"< 7.38.0-4+deb8u13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7141","fix":{"state":"fixed","versions":["7.38.0-4+deb8u13"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u13"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7141","cwe":"CWE-287","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7141","date":"2026-10-10","epss":0.0818,"percentile":0.94745}],"risk":4.09,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7141"},"relatedVulnerabilities":[{"id":"CVE-2016-7141","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7141","cwe":"CWE-287","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7141","date":"2026-10-10","epss":0.0818,"percentile":0.94745}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92754","http://www.securitytracker.com/id/1036739","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=1373229","https://curl.haxx.se/docs/adv_20160907.html","https://github.com/curl/curl/commit/curl-7_50_2~32","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://security.gentoo.org/glsa/201701-47"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7141","description":"curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u111-2.6.7-2~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5582","versionConstraint":"< 7u111-2.6.7-2~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-5582","fix":{"state":"fixed","versions":["7u111-2.6.7-2~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u111-2.6.7-2~deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5582","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5582","date":"2026-10-10","epss":0.05437,"percentile":0.92528}],"risk":4.07775,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3707-1","link":"https://security-tracker.debian.org/tracker/DSA-3707-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-5582"},"relatedVulnerabilities":[{"id":"CVE-2016-5582","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5582","cwe":"CWE-284","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5582","date":"2026-10-10","epss":0.05437,"percentile":0.92528}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-2079.html","http://rhn.redhat.com/errata/RHSA-2016-2088.html","http://rhn.redhat.com/errata/RHSA-2016-2089.html","http://rhn.redhat.com/errata/RHSA-2016-2090.html","http://rhn.redhat.com/errata/RHSA-2016-2658.html","http://rhn.redhat.com/errata/RHSA-2017-0061.html","http://www.debian.org/security/2016/dsa-3707","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.securityfocus.com/bid/93623","http://www.securitytracker.com/id/1037040","http://www.ubuntu.com/usn/USN-3130-1","http://www.ubuntu.com/usn/USN-3154-1","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201611-04","https://security.gentoo.org/glsa/201701-43","https://security.netapp.com/advisory/ntap-20161019-0001/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5582","description":"Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; and Java SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5573."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-5421","versionConstraint":"< 7.38.0-4+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-5421","fix":{"state":"fixed","versions":["7.38.0-4+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5421","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5421","date":"2026-10-10","epss":0.08037,"percentile":0.94662}],"risk":4.0184999999999995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3638-1","link":"https://security-tracker.debian.org/tracker/DSA-3638-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-5421"},"relatedVulnerabilities":[{"id":"CVE-2016-5421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5421","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5421","date":"2026-10-10","epss":0.08037,"percentile":0.94662}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92306","http://www.securitytracker.com/id/1036536","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803C.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5421","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5421","versionConstraint":"< 7.38.0-4+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-5421","fix":{"state":"fixed","versions":["7.38.0-4+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5421","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5421","date":"2026-10-10","epss":0.08037,"percentile":0.94662}],"risk":4.0184999999999995,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3638-1","link":"https://security-tracker.debian.org/tracker/DSA-3638-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-5421"},"relatedVulnerabilities":[{"id":"CVE-2016-5421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5421","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5421","date":"2026-10-10","epss":0.08037,"percentile":0.94662}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92306","http://www.securitytracker.com/id/1036536","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803C.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5421","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"0edcd4b35209fc0e","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/debian/libsasl2-2@2.1.26.dfsg1-13%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=cyrus-sasl2","type":"deb","version":"2.1.26.dfsg1-13+deb8u1","language":"","licenses":["sha256:3d86a5cd7ef3aff67b163975511a7433139921749fc38ef26f75e3830053fbb0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.26.dfsg1-13+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"< 2.1.26.dfsg1-13+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"cyrus-sasl2","version":"2.1.26.dfsg1-13+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"fixed","versions":["2.1.26.dfsg1-13+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.26.dfsg1-13+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-10","epss":0.08036,"percentile":0.9466}],"risk":4.018,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19906"},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-10","epss":0.08036,"percentile":0.9466}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"c9f7a7dc73893658","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.26.dfsg1-13\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/debian/libsasl2-modules-db@2.1.26.dfsg1-13%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=cyrus-sasl2","type":"deb","version":"2.1.26.dfsg1-13+deb8u1","language":"","licenses":["sha256:3d86a5cd7ef3aff67b163975511a7433139921749fc38ef26f75e3830053fbb0"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.26.dfsg1-13+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"< 2.1.26.dfsg1-13+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"cyrus-sasl2","version":"2.1.26.dfsg1-13+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"fixed","versions":["2.1.26.dfsg1-13+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.26.dfsg1-13+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-10","epss":0.08036,"percentile":0.9466}],"risk":4.018,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19906"},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-10","epss":0.08036,"percentile":0.9466}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"db8ea562e46a3772","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19603","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19603","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-19603","date":"2026-10-10","epss":0.0803,"percentile":0.94656}],"risk":4.015,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19603"},"relatedVulnerabilities":[{"id":"CVE-2019-19603","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-19603","date":"2026-10-10","epss":0.0803,"percentile":0.94656}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/sqlite/sqlite/commit/527cbd4a104cb93bf3994b3dd3619a6299a78b13","https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E","https://security.netapp.com/advisory/ntap-20191223-0001/","https://usn.ubuntu.com/4394-1/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.sqlite.org/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19603","description":"SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash."}]},{"artifact":{"id":"086860a1c675b6eb","cpes":["cpe:2.3:a:libgnutls-deb0-28:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0-28:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0_28:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_deb0:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-deb0-28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_deb0_28:3.3.8-6\\+deb8u3:*:*:*:*:*:*:*"],"name":"libgnutls-deb0-28","purl":"pkg:deb/debian/libgnutls-deb0-28@3.3.8-6%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=gnutls28","type":"deb","version":"3.3.8-6+deb8u3","language":"","licenses":["sha256:cffad6d97811bc8c8755b86819dbece70c2da355bf2d50a24bdc0e85a6cc2fef"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-deb0-28/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libgnutls-deb0-28/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libgnutls-deb0-28:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.3.8-6+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5335","versionConstraint":"< 3.3.8-6+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"gnutls28","version":"3.3.8-6+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-5335","fix":{"state":"fixed","versions":["3.3.8-6+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.3.8-6+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5335","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5335","date":"2026-10-10","epss":0.08009,"percentile":0.94644}],"risk":4.0045,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-5335"},"relatedVulnerabilities":[{"id":"CVE-2017-5335","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5335","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5335","date":"2026-10-10","epss":0.08009,"percentile":0.94644}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://www.openwall.com/lists/oss-security/2017/01/10/7","http://www.openwall.com/lists/oss-security/2017/01/11/4","http://www.securityfocus.com/bid/95374","http://www.securitytracker.com/id/1037576","https://access.redhat.com/errata/RHSA-2017:2292","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=337","https://gitlab.com/gnutls/gnutls/commit/49be4f7b82eba2363bb8d4090950dad976a77a3a","https://gnutls.org/security.html#GNUTLS-SA-2017-2","https://security.gentoo.org/glsa/201702-04"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5335","description":"The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate."}]},{"artifact":{"id":"db8ea562e46a3772","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-8740","versionConstraint":"< 3.8.7.1-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-8740","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-8740","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-8740","date":"2026-10-10","epss":0.07966,"percentile":0.94621}],"risk":3.9829999999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-8740"},"relatedVulnerabilities":[{"id":"CVE-2018-8740","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-8740","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-8740","date":"2026-10-10","epss":0.07966,"percentile":0.94621}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00050.html","http://www.securityfocus.com/bid/103466","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6964","https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1756349","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/","https://usn.ubuntu.com/4205-1/","https://usn.ubuntu.com/4394-1/","https://www.sqlite.org/cgi/src/timeline?r=corrupt-schema","https://www.sqlite.org/cgi/src/vdiff?from=1774f1c3baf0bc3d&to=d75e67654aa9620b"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-8740","description":"In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c."}]},{"artifact":{"id":"db8ea562e46a3772","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-2518","versionConstraint":"< 3.8.7.1-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-2518","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-2518","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-2518","date":"2026-10-10","epss":0.05279,"percentile":0.92375}],"risk":3.9592499999999995,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-2518"},"relatedVulnerabilities":[{"id":"CVE-2017-2518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-2518","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-2518","date":"2026-10-10","epss":0.05279,"percentile":0.92375}],"urls":["http://www.securityfocus.com/bid/98468","http://www.securitytracker.com/id/1038484","https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html","https://support.apple.com/HT207797","https://support.apple.com/HT207798","https://support.apple.com/HT207800","https://support.apple.com/HT207801","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-2518","description":"An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the \"SQLite\" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted SQL statement."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3862","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3862","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3862","cwe":"CWE-130","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3862","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3862","date":"2026-10-10","epss":0.07898,"percentile":0.94589}],"risk":3.949,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3862"},"relatedVulnerabilities":[{"id":"CVE-2019-3862","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3862","cwe":"CWE-130","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3862","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3862","date":"2026-10-10","epss":0.07898,"percentile":0.94589}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html","http://www.openwall.com/lists/oss-security/2019/03/18/3","http://www.securityfocus.com/bid/107485","https://access.redhat.com/errata/RHSA-2019:1884","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3862","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/","https://seclists.org/bugtraq/2019/Apr/25","https://seclists.org/bugtraq/2019/Mar/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3862.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3862","description":"An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory."}]},{"artifact":{"id":"313fa3578fbafcd9","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u2:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"2.9.1+dfsg1-5+deb8u2","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-7595","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-7595","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-7595","date":"2026-10-10","epss":0.07836,"percentile":0.9455}],"risk":3.918,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-7595"},"relatedVulnerabilities":[{"id":"CVE-2020-7595","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-7595","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-7595","date":"2026-10-10","epss":0.07836,"percentile":0.9455}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf","https://gitlab.gnome.org/GNOME/libxml2/commit/0e1a49c89076","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/545SPOI3ZPPNPX4TFRIVE4JVRTJRKULL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.gentoo.org/glsa/202010-04","https://security.netapp.com/advisory/ntap-20200702-0005/","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08","https://usn.ubuntu.com/4274-1/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-7595","description":"xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9m6f-7xcq-8vf8","versionConstraint":">=2.0.0,<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9m6f-7xcq-8vf8","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36183","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36183","date":"2026-10-10","epss":0.04972,"percentile":0.91993}],"risk":3.87816,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36183","https://github.com/FasterXML/jackson-databind/issues/3003","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/12e23c962ffb4cf1857c5461d72ae54cc8008f29","https://security.netapp.com/advisory/ntap-20210205-0005"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9m6f-7xcq-8vf8","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36183","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36183","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36183","date":"2026-10-10","epss":0.04972,"percentile":0.91993}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/3003","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36183","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-9m6f-7xcq-8vf8","versionConstraint":">=2.0.0,<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-9m6f-7xcq-8vf8","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36183","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36183","date":"2026-10-10","epss":0.04972,"percentile":0.91993}],"risk":3.87816,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36183","https://github.com/FasterXML/jackson-databind/issues/3003","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/12e23c962ffb4cf1857c5461d72ae54cc8008f29","https://security.netapp.com/advisory/ntap-20210205-0005"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9m6f-7xcq-8vf8","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36183","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36183","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36183","date":"2026-10-10","epss":0.04972,"percentile":0.91993}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/3003","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36183","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool."}]},{"artifact":{"id":"796f2a2a2aa72b2c","cpes":["cpe:2.3:a:libicu52:libicu52:52.1-8\\+deb8u3:*:*:*:*:*:*:*"],"name":"libicu52","purl":"pkg:deb/debian/libicu52@52.1-8%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=icu","type":"deb","version":"52.1-8+deb8u3","language":"","licenses":["sha256:d1fcfd4dec63109efa1c8e00748a9bf2cb1d1682bb7fc281c9509efc26e3d487"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libicu52/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libicu52/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libicu52:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libicu52:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"icu"}]},"matchDetails":[{"fix":{"suggestedVersion":"52.1-8+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-14952","versionConstraint":"< 52.1-8+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"icu","version":"52.1-8+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14952","fix":{"state":"fixed","versions":["52.1-8+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"52.1-8+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-14952","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14952","date":"2026-10-10","epss":0.05096,"percentile":0.92161}],"risk":3.8219999999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14952"},"relatedVulnerabilities":[{"id":"CVE-2017-14952","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14952","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14952","date":"2026-10-10","epss":0.05096,"percentile":0.92161}],"urls":["http://bugs.icu-project.org/trac/changeset/40324/trunk/icu4c/source/i18n/zonemeta.cpp","http://www.sourcebrella.com/blog/double-free-vulnerability-international-components-unicode-icu/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14952","description":"Double free in i18n/zonemeta.cpp in International Components for Unicode (ICU) for C/C++ through 59.1 allows remote attackers to execute arbitrary code via a crafted string, aka a \"redundant UVector entry clean up function call\" issue."}]},{"artifact":{"id":"db8ea562e46a3772","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20506","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-20506","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20506","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20506","date":"2026-10-10","epss":0.07565,"percentile":0.9439}],"risk":3.7824999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20506"},"relatedVulnerabilities":[{"id":"CVE-2018-20506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20506","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20506","date":"2026-10-10","epss":0.07565,"percentile":0.9439}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html","http://seclists.org/fulldisclosure/2019/Jan/62","http://seclists.org/fulldisclosure/2019/Jan/64","http://seclists.org/fulldisclosure/2019/Jan/66","http://seclists.org/fulldisclosure/2019/Jan/67","http://seclists.org/fulldisclosure/2019/Jan/68","http://seclists.org/fulldisclosure/2019/Jan/69","http://www.securityfocus.com/bid/106698","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://seclists.org/bugtraq/2019/Jan/28","https://seclists.org/bugtraq/2019/Jan/29","https://seclists.org/bugtraq/2019/Jan/31","https://seclists.org/bugtraq/2019/Jan/32","https://seclists.org/bugtraq/2019/Jan/33","https://seclists.org/bugtraq/2019/Jan/39","https://security.netapp.com/advisory/ntap-20190502-0004/","https://sqlite.org/src/info/940f2adc8541a838","https://support.apple.com/kb/HT209443","https://support.apple.com/kb/HT209446","https://support.apple.com/kb/HT209447","https://support.apple.com/kb/HT209448","https://support.apple.com/kb/HT209450","https://support.apple.com/kb/HT209451","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20506","description":"SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a \"merge\" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346."}]},{"artifact":{"id":"796f2a2a2aa72b2c","cpes":["cpe:2.3:a:libicu52:libicu52:52.1-8\\+deb8u3:*:*:*:*:*:*:*"],"name":"libicu52","purl":"pkg:deb/debian/libicu52@52.1-8%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=icu","type":"deb","version":"52.1-8+deb8u3","language":"","licenses":["sha256:d1fcfd4dec63109efa1c8e00748a9bf2cb1d1682bb7fc281c9509efc26e3d487"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libicu52/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libicu52/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libicu52:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libicu52:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"icu"}]},"matchDetails":[{"fix":{"suggestedVersion":"52.1-8+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6293","versionConstraint":"< 52.1-8+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"icu","version":"52.1-8+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6293","fix":{"state":"fixed","versions":["52.1-8+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"52.1-8+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6293","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6293","date":"2026-10-10","epss":0.05019,"percentile":0.92053}],"risk":3.7642499999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3725-1","link":"https://security-tracker.debian.org/tracker/DSA-3725-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6293"},"relatedVulnerabilities":[{"id":"CVE-2016-6293","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6293","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6293","date":"2026-10-10","epss":0.05019,"percentile":0.92053}],"urls":["http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4","http://openwall.com/lists/oss-security/2016/07/24/2","http://www.securityfocus.com/bid/92127","https://bugs.php.net/72533","https://security.gentoo.org/glsa/201701-58","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6293","description":"The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument."}]},{"artifact":{"id":"7eaafe3de0d9d3c6","cpes":["cpe:2.3:a:wget:wget:1.16-1:*:*:*:*:*:*:*"],"name":"wget","purl":"pkg:deb/debian/wget@1.16-1?arch=amd64&distro=debian-8.5","type":"deb","version":"1.16-1","language":"","licenses":["sha256:c58cb5a2d94f35f0e9b0f1a038d48b73477aa12782ff17328c21d8a86f5f99d5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/wget/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/wget/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/wget.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/wget.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.16-1+deb8u7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-7098","versionConstraint":"< 1.16-1+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"wget","version":"1.16-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7098","fix":{"state":"fixed","versions":["1.16-1+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.16-1+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7098","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7098","date":"2026-10-10","epss":0.07499,"percentile":0.94349}],"risk":3.7495000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7098"},"relatedVulnerabilities":[{"id":"CVE-2016-7098","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7098","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7098","date":"2026-10-10","epss":0.07499,"percentile":0.94349}],"urls":["http://lists.gnu.org/archive/html/bug-wget/2016-08/msg00083.html","http://lists.gnu.org/archive/html/bug-wget/2016-08/msg00134.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00044.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00007.html","http://www.openwall.com/lists/oss-security/2016/08/27/2","http://www.securityfocus.com/bid/93157","https://lists.debian.org/debian-lts-announce/2020/01/msg00031.html","https://www.exploit-db.com/exploits/40824/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7098","description":"Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-8619","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8619","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8619","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8619","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8619","date":"2026-10-10","epss":0.04989,"percentile":0.92015}],"risk":3.74175,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8619"},"relatedVulnerabilities":[{"id":"CVE-2016-8619","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8619","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8619","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8619","date":"2026-10-10","epss":0.04989,"percentile":0.92015}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94100","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8619","https://curl.haxx.se/CVE-2016-8619.patch","https://curl.haxx.se/docs/adv_20161102E.html","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8619","description":"The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8619","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8619","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8619","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8619","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8619","date":"2026-10-10","epss":0.04989,"percentile":0.92015}],"risk":3.74175,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8619"},"relatedVulnerabilities":[{"id":"CVE-2016-8619","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8619","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8619","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8619","date":"2026-10-10","epss":0.04989,"percentile":0.92015}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94100","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8619","https://curl.haxx.se/CVE-2016-8619.patch","https://curl.haxx.se/docs/adv_20161102E.html","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8619","description":"The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8619","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8619","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8619","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8619","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8619","date":"2026-10-10","epss":0.04989,"percentile":0.92015}],"risk":3.74175,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8619"},"relatedVulnerabilities":[{"id":"CVE-2016-8619","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8619","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8619","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8619","date":"2026-10-10","epss":0.04989,"percentile":0.92015}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94100","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8619","https://curl.haxx.se/CVE-2016-8619.patch","https://curl.haxx.se/docs/adv_20161102E.html","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8619","description":"The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free."}]},{"artifact":{"id":"3f4070a357b07c66","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:215-17\\+deb8u4:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/debian/libsystemd0@215-17%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=systemd","type":"deb","version":"215-17+deb8u4","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"systemd","version":"215-17+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-10","epss":0.07441,"percentile":0.94317}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-10","epss":0.07441,"percentile":0.94317}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"b14079cdb8c236e9","cpes":["cpe:2.3:a:libudev1:libudev1:215-17\\+deb8u4:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/debian/libudev1@215-17%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=systemd","type":"deb","version":"215-17+deb8u4","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"systemd","version":"215-17+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-10","epss":0.07441,"percentile":0.94317}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-10","epss":0.07441,"percentile":0.94317}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"dda2fa627d491e3c","cpes":["cpe:2.3:a:systemd:systemd:215-17\\+deb8u4:*:*:*:*:*:*:*"],"name":"systemd","purl":"pkg:deb/debian/systemd@215-17%2Bdeb8u4?arch=amd64&distro=debian-8.5","type":"deb","version":"215-17+deb8u4","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/systemd/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/systemd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/systemd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/systemd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/systemd.list"},{"path":"/var/lib/dpkg/info/systemd.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/systemd.postinst"},{"path":"/var/lib/dpkg/info/systemd.postrm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/systemd.postrm"},{"path":"/var/lib/dpkg/info/systemd.preinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/systemd.preinst"},{"path":"/var/lib/dpkg/info/systemd.prerm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/systemd.prerm"},{"path":"/var/lib/dpkg/info/systemd.triggers","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/systemd.triggers"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"systemd","version":"215-17+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-10","epss":0.07441,"percentile":0.94317}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-10","epss":0.07441,"percentile":0.94317}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"e9c17c1d388b44bf","cpes":["cpe:2.3:a:systemd-sysv:systemd-sysv:215-17\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:systemd-sysv:systemd_sysv:215-17\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:systemd_sysv:systemd-sysv:215-17\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:systemd_sysv:systemd_sysv:215-17\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd-sysv:215-17\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:systemd:systemd_sysv:215-17\\+deb8u4:*:*:*:*:*:*:*"],"name":"systemd-sysv","purl":"pkg:deb/debian/systemd-sysv@215-17%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=systemd","type":"deb","version":"215-17+deb8u4","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/systemd-sysv/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/systemd-sysv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd-sysv.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/systemd-sysv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/systemd-sysv.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/systemd-sysv.list"}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"systemd","version":"215-17+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-10","epss":0.07441,"percentile":0.94317}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-10","epss":0.07441,"percentile":0.94317}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"74baf5389374965d","cpes":["cpe:2.3:a:udev:udev:215-17\\+deb8u4:*:*:*:*:*:*:*"],"name":"udev","purl":"pkg:deb/debian/udev@215-17%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=systemd","type":"deb","version":"215-17+deb8u4","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/udev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/udev.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/udev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/udev.list"},{"path":"/var/lib/dpkg/info/udev.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/udev.postinst"},{"path":"/var/lib/dpkg/info/udev.postrm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/udev.postrm"},{"path":"/var/lib/dpkg/info/udev.preinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/udev.preinst"},{"path":"/var/lib/dpkg/info/udev.prerm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/udev.prerm"},{"path":"/var/lib/dpkg/info/udev.templates","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/udev.templates"},{"path":"/var/lib/dpkg/info/udev.triggers","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/udev.triggers"}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"215-17+deb8u8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 215-17+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"systemd","version":"215-17+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["215-17+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"215-17+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-10","epss":0.07441,"percentile":0.94317}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-10","epss":0.07441,"percentile":0.94317}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2795","versionConstraint":"< 7u181-2.6.14-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-2795","fix":{"state":"fixed","versions":["7u181-2.6.14-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u181-2.6.14-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2795","date":"2026-10-10","epss":0.07393,"percentile":0.94292}],"risk":3.6965,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4225-1","link":"https://security-tracker.debian.org/tracker/DSA-4225-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-2795"},"relatedVulnerabilities":[{"id":"CVE-2018-2795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2795","date":"2026-10-10","epss":0.07393,"percentile":0.94292}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103847","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2795","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2797","versionConstraint":"< 7u181-2.6.14-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-2797","fix":{"state":"fixed","versions":["7u181-2.6.14-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u181-2.6.14-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2797","date":"2026-10-10","epss":0.07393,"percentile":0.94291}],"risk":3.6965,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4225-1","link":"https://security-tracker.debian.org/tracker/DSA-4225-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-2797"},"relatedVulnerabilities":[{"id":"CVE-2018-2797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2797","date":"2026-10-10","epss":0.07393,"percentile":0.94291}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103846","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2797","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2798","versionConstraint":"< 7u181-2.6.14-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-2798","fix":{"state":"fixed","versions":["7u181-2.6.14-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u181-2.6.14-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2798","date":"2026-10-10","epss":0.07393,"percentile":0.94291}],"risk":3.6965,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4225-1","link":"https://security-tracker.debian.org/tracker/DSA-4225-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-2798"},"relatedVulnerabilities":[{"id":"CVE-2018-2798","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2798","date":"2026-10-10","epss":0.07393,"percentile":0.94291}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103841","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2798","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"d91ce551dcf6c33f","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-18+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3075","versionConstraint":"< 2.19-18+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3075","fix":{"state":"fixed","versions":["2.19-18+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.19-18+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3075","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3075","date":"2026-10-10","epss":0.07335,"percentile":0.94254}],"risk":3.6675,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3075"},"relatedVulnerabilities":[{"id":"CVE-2016-3075","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3075","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3075","date":"2026-10-10","epss":0.07335,"percentile":0.94254}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html","http://rhn.redhat.com/errata/RHSA-2016-2573.html","http://www.securityfocus.com/bid/85732","http://www.ubuntu.com/usn/USN-2985-1","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=19879","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=317b199b4aff8cfa27f2302ab404d2bb5032b9a4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3075","description":"Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name."}]},{"artifact":{"id":"495e1452a66e5099","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-18+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3075","versionConstraint":"< 2.19-18+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3075","fix":{"state":"fixed","versions":["2.19-18+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.19-18+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3075","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3075","date":"2026-10-10","epss":0.07335,"percentile":0.94254}],"risk":3.6675,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3075"},"relatedVulnerabilities":[{"id":"CVE-2016-3075","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3075","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3075","date":"2026-10-10","epss":0.07335,"percentile":0.94254}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html","http://rhn.redhat.com/errata/RHSA-2016-2573.html","http://www.securityfocus.com/bid/85732","http://www.ubuntu.com/usn/USN-2985-1","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=19879","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=317b199b4aff8cfa27f2302ab404d2bb5032b9a4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3075","description":"Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name."}]},{"artifact":{"id":"6dec8d97d34362ed","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-18+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3075","versionConstraint":"< 2.19-18+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3075","fix":{"state":"fixed","versions":["2.19-18+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.19-18+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3075","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3075","date":"2026-10-10","epss":0.07335,"percentile":0.94254}],"risk":3.6675,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3075"},"relatedVulnerabilities":[{"id":"CVE-2016-3075","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3075","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3075","date":"2026-10-10","epss":0.07335,"percentile":0.94254}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html","http://rhn.redhat.com/errata/RHSA-2016-2573.html","http://www.securityfocus.com/bid/85732","http://www.ubuntu.com/usn/USN-2985-1","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=19879","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=317b199b4aff8cfa27f2302ab404d2bb5032b9a4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3075","description":"Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name."}]},{"artifact":{"id":"57469482e26b9740","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-10","epss":0.04879,"percentile":0.91853}],"risk":3.65925,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878"},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-10","epss":0.04879,"percentile":0.91853}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"71183f78a986047d","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-10","epss":0.04879,"percentile":0.91853}],"risk":3.65925,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878"},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-10","epss":0.04879,"percentile":0.91853}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"16a442ba7a1a09d3","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u6?arch=all&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10878","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-10878","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-10","epss":0.04879,"percentile":0.91853}],"risk":3.65925,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-10878"},"relatedVulnerabilities":[{"id":"CVE-2020-10878","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10878","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10878","date":"2026-10-10","epss":0.04879,"percentile":0.91853}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8","https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10878","description":"Perl before 5.30.3 has an integer overflow related to mishandling of a \"PL_regkind[OP(n)] == NOTHING\" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection."}]},{"artifact":{"id":"636d5dbdc8a9bee4","cpes":["cpe:2.3:a:libncurses5:libncurses5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncurses5","purl":"pkg:deb/debian/libncurses5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.5&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libncurses5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10684","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10684","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-10","epss":0.04876,"percentile":0.91849}],"risk":3.657,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10684"},"relatedVulnerabilities":[{"id":"CVE-2017-10684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-10","epss":0.04876,"percentile":0.91849}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464687","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10684","description":"In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"58463c1cc3a120f0","cpes":["cpe:2.3:a:libncursesw5:libncursesw5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncursesw5","purl":"pkg:deb/debian/libncursesw5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.5&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libncursesw5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10684","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10684","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-10","epss":0.04876,"percentile":0.91849}],"risk":3.657,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10684"},"relatedVulnerabilities":[{"id":"CVE-2017-10684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-10","epss":0.04876,"percentile":0.91849}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464687","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10684","description":"In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"09d5d8f682c38b75","cpes":["cpe:2.3:a:libtinfo5:libtinfo5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libtinfo5","purl":"pkg:deb/debian/libtinfo5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.5&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libtinfo5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10684","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10684","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-10","epss":0.04876,"percentile":0.91849}],"risk":3.657,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10684"},"relatedVulnerabilities":[{"id":"CVE-2017-10684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-10","epss":0.04876,"percentile":0.91849}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464687","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10684","description":"In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"6293c813c118596f","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@5.9%2B20140913-1?arch=all&distro=debian-8.5&upstream=ncurses","type":"deb","version":"5.9+20140913-1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10684","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10684","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-10","epss":0.04876,"percentile":0.91849}],"risk":3.657,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10684"},"relatedVulnerabilities":[{"id":"CVE-2017-10684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-10","epss":0.04876,"percentile":0.91849}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464687","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10684","description":"In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"3cc6082f3526cf55","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.5&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10684","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10684","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-10","epss":0.04876,"percentile":0.91849}],"risk":3.657,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10684"},"relatedVulnerabilities":[{"id":"CVE-2017-10684","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10684","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10684","date":"2026-10-10","epss":0.04876,"percentile":0.91849}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464687","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10684","description":"In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"57469482e26b9740","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u11"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-12015","versionConstraint":"< 5.20.2-3+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12015","fix":{"state":"fixed","versions":["5.20.2-3+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-10","epss":0.0731,"percentile":0.9424}],"risk":3.655,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4226-1","link":"https://security-tracker.debian.org/tracker/DSA-4226-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12015"},"relatedVulnerabilities":[{"id":"CVE-2018-12015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-10","epss":0.0731,"percentile":0.9424}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/104423","http://www.securitytracker.com/id/1041048","https://access.redhat.com/errata/RHSA-2019:2097","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834","https://seclists.org/bugtraq/2019/Mar/42","https://security.netapp.com/advisory/ntap-20180927-0001/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3684-1/","https://usn.ubuntu.com/3684-2/","https://www.debian.org/security/2018/dsa-4226","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12015","description":"In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name."}]},{"artifact":{"id":"71183f78a986047d","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12015","versionConstraint":"< 5.20.2-3+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12015","fix":{"state":"fixed","versions":["5.20.2-3+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-10","epss":0.0731,"percentile":0.9424}],"risk":3.655,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4226-1","link":"https://security-tracker.debian.org/tracker/DSA-4226-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12015"},"relatedVulnerabilities":[{"id":"CVE-2018-12015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-10","epss":0.0731,"percentile":0.9424}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/104423","http://www.securitytracker.com/id/1041048","https://access.redhat.com/errata/RHSA-2019:2097","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834","https://seclists.org/bugtraq/2019/Mar/42","https://security.netapp.com/advisory/ntap-20180927-0001/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3684-1/","https://usn.ubuntu.com/3684-2/","https://www.debian.org/security/2018/dsa-4226","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12015","description":"In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name."}]},{"artifact":{"id":"16a442ba7a1a09d3","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u6?arch=all&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12015","versionConstraint":"< 5.20.2-3+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-12015","fix":{"state":"fixed","versions":["5.20.2-3+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-10","epss":0.0731,"percentile":0.9424}],"risk":3.655,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4226-1","link":"https://security-tracker.debian.org/tracker/DSA-4226-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-12015"},"relatedVulnerabilities":[{"id":"CVE-2018-12015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-10","epss":0.0731,"percentile":0.9424}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/104423","http://www.securitytracker.com/id/1041048","https://access.redhat.com/errata/RHSA-2019:2097","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834","https://seclists.org/bugtraq/2019/Mar/42","https://security.netapp.com/advisory/ntap-20180927-0001/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3684-1/","https://usn.ubuntu.com/3684-2/","https://www.debian.org/security/2018/dsa-4226","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12015","description":"In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.12.6.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57j2-w4cx-62h2","versionConstraint":"<=2.12.6.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57j2-w4cx-62h2","fix":{"state":"fixed","versions":["2.12.6.1"],"available":[{"date":"2022-03-29","kind":"first-observed","version":"2.12.6.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36518","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36518","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36518","date":"2026-10-10","epss":0.0486,"percentile":0.91827}],"risk":3.6449999999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36518","https://github.com/FasterXML/jackson-databind/issues/2816","https://github.com/FasterXML/jackson-databind/commit/fcfc4998ec23f0b1f7f8a9521c2b317b6c25892b","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.12","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13","https://lists.debian.org/debian-lts-announce/2022/05/msg00001.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html","https://www.debian.org/security/2022/dsa-5283","https://github.com/FasterXML/jackson-databind/commit/0a8157c6ca478b1bc7be4ba7dccdb3863275f0de","https://github.com/FasterXML/jackson-databind/commit/3cc52f82ecf943e06c1d7c3b078e405fb3923d2b","https://github.com/FasterXML/jackson-databind/commit/8238ab41d0350fb915797c89d46777b4496b74fd","https://github.com/FasterXML/jackson-databind/commit/b3587924ee5d8695942f364d0d404d48d0ea6126","https://security.netapp.com/advisory/ntap-20220506-0004"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57j2-w4cx-62h2","description":"Deeply nested json in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36518","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36518","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36518","date":"2026-10-10","epss":0.0486,"percentile":0.91827}],"urls":["https://github.com/FasterXML/jackson-databind/issues/2816","https://lists.debian.org/debian-lts-announce/2022/05/msg00001.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html","https://security.netapp.com/advisory/ntap-20220506-0004/","https://www.debian.org/security/2022/dsa-5283","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36518","description":"jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.12.6.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-57j2-w4cx-62h2","versionConstraint":"<=2.12.6.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-57j2-w4cx-62h2","fix":{"state":"fixed","versions":["2.12.6.1"],"available":[{"date":"2022-03-29","kind":"first-observed","version":"2.12.6.1"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36518","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36518","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36518","date":"2026-10-10","epss":0.0486,"percentile":0.91827}],"risk":3.6449999999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36518","https://github.com/FasterXML/jackson-databind/issues/2816","https://github.com/FasterXML/jackson-databind/commit/fcfc4998ec23f0b1f7f8a9521c2b317b6c25892b","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.12","https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13","https://lists.debian.org/debian-lts-announce/2022/05/msg00001.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html","https://www.debian.org/security/2022/dsa-5283","https://github.com/FasterXML/jackson-databind/commit/0a8157c6ca478b1bc7be4ba7dccdb3863275f0de","https://github.com/FasterXML/jackson-databind/commit/3cc52f82ecf943e06c1d7c3b078e405fb3923d2b","https://github.com/FasterXML/jackson-databind/commit/8238ab41d0350fb915797c89d46777b4496b74fd","https://github.com/FasterXML/jackson-databind/commit/b3587924ee5d8695942f364d0d404d48d0ea6126","https://security.netapp.com/advisory/ntap-20220506-0004"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-57j2-w4cx-62h2","description":"Deeply nested json in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36518","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36518","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36518","date":"2026-10-10","epss":0.0486,"percentile":0.91827}],"urls":["https://github.com/FasterXML/jackson-databind/issues/2816","https://lists.debian.org/debian-lts-announce/2022/05/msg00001.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00035.html","https://security.netapp.com/advisory/ntap-20220506-0004/","https://www.debian.org/security/2022/dsa-5283","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36518","description":"jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-8618","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8618","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8618","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8618","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8618","date":"2026-10-10","epss":0.04837,"percentile":0.91789}],"risk":3.6277500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8618"},"relatedVulnerabilities":[{"id":"CVE-2016-8618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8618","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8618","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8618","date":"2026-10-10","epss":0.04837,"percentile":0.91789}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94098","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8618","https://curl.haxx.se/docs/adv_20161102D.html","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8618","description":"The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8618","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8618","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8618","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8618","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8618","date":"2026-10-10","epss":0.04837,"percentile":0.91789}],"risk":3.6277500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8618"},"relatedVulnerabilities":[{"id":"CVE-2016-8618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8618","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8618","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8618","date":"2026-10-10","epss":0.04837,"percentile":0.91789}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94098","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8618","https://curl.haxx.se/docs/adv_20161102D.html","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8618","description":"The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8618","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8618","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8618","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8618","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8618","date":"2026-10-10","epss":0.04837,"percentile":0.91789}],"risk":3.6277500000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8618"},"relatedVulnerabilities":[{"id":"CVE-2016-8618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8618","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8618","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8618","date":"2026-10-10","epss":0.04837,"percentile":0.91789}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94098","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8618","https://curl.haxx.se/docs/adv_20161102D.html","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8618","description":"The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to an unsafe `size_t` multiplication, on systems using 32 bit `size_t` variables."}]},{"artifact":{"id":"2cf7debe7a73e2c2","cpes":["cpe:2.3:a:apt:apt:1.0.9.8.3:*:*:*:*:*:*:*"],"name":"apt","purl":"pkg:deb/debian/apt@1.0.9.8.3?arch=amd64&distro=debian-8.5","type":"deb","version":"1.0.9.8.3","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/apt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.list"},{"path":"/var/lib/dpkg/info/apt.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.postinst"},{"path":"/var/lib/dpkg/info/apt.postrm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.postrm"},{"path":"/var/lib/dpkg/info/apt.preinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.preinst"},{"path":"/var/lib/dpkg/info/apt.prerm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.prerm"},{"path":"/var/lib/dpkg/info/apt.shlibs","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/apt.shlibs"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.9.8.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-1252","versionConstraint":"< 1.0.9.8.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"apt","version":"1.0.9.8.3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-1252","fix":{"state":"fixed","versions":["1.0.9.8.4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.9.8.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-10","epss":0.07248,"percentile":0.94199}],"risk":3.624,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3733-1","link":"https://security-tracker.debian.org/tracker/DSA-3733-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-1252"},"relatedVulnerabilities":[{"id":"CVE-2016-1252","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-10","epss":0.07248,"percentile":0.94199}],"urls":["http://packetstormsecurity.com/files/140145/apt-Repository-Signing-Bypass.html","http://www.ubuntu.com/usn/USN-3156-1","https://bugs.chromium.org/p/project-zero/issues/detail?id=1020","https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467","https://www.debian.org/security/2016/dsa-3733","https://www.exploit-db.com/exploits/40916/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1252","description":"The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures."}]},{"artifact":{"id":"677c8dbae870140b","cpes":["cpe:2.3:a:libapt-pkg4.12:libapt-pkg4.12:1.0.9.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt-pkg4.12:libapt_pkg4.12:1.0.9.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt-pkg4.12:1.0.9.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt_pkg4.12:1.0.9.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-pkg4.12:1.0.9.8.3:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_pkg4.12:1.0.9.8.3:*:*:*:*:*:*:*"],"name":"libapt-pkg4.12","purl":"pkg:deb/debian/libapt-pkg4.12@1.0.9.8.3?arch=amd64&distro=debian-8.5&upstream=apt","type":"deb","version":"1.0.9.8.3","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-pkg4.12/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libapt-pkg4.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.9.8.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-1252","versionConstraint":"< 1.0.9.8.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"apt","version":"1.0.9.8.3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-1252","fix":{"state":"fixed","versions":["1.0.9.8.4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.0.9.8.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-10","epss":0.07248,"percentile":0.94199}],"risk":3.624,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3733-1","link":"https://security-tracker.debian.org/tracker/DSA-3733-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-1252"},"relatedVulnerabilities":[{"id":"CVE-2016-1252","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-10","epss":0.07248,"percentile":0.94199}],"urls":["http://packetstormsecurity.com/files/140145/apt-Repository-Signing-Bypass.html","http://www.ubuntu.com/usn/USN-3156-1","https://bugs.chromium.org/p/project-zero/issues/detail?id=1020","https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467","https://www.debian.org/security/2016/dsa-3733","https://www.exploit-db.com/exploits/40916/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1252","description":"The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures."}]},{"artifact":{"id":"3266613933064841","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.40%2Bdfsg-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openldap","type":"deb","version":"2.4.40+dfsg-1+deb8u2","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.40+dfsg-1+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-9287","versionConstraint":"< 2.4.40+dfsg-1+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openldap","version":"2.4.40+dfsg-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-9287","fix":{"state":"fixed","versions":["2.4.40+dfsg-1+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.40+dfsg-1+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-9287","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9287","date":"2026-10-10","epss":0.07201,"percentile":0.94167}],"risk":3.6005000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3868-1","link":"https://security-tracker.debian.org/tracker/DSA-3868-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-9287"},"relatedVulnerabilities":[{"id":"CVE-2017-9287","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9287","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9287","date":"2026-10-10","epss":0.07201,"percentile":0.94167}],"urls":["http://www.debian.org/security/2017/dsa-3868","http://www.openldap.org/its/?findid=8655","http://www.securityfocus.com/bid/98736","http://www.securitytracker.com/id/1038591","https://access.redhat.com/errata/RHSA-2017:1852","https://bugs.debian.org/863563","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9287","description":"servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0."}]},{"artifact":{"id":"c6e6b72ebd423a03","cpes":["cpe:2.3:a:libx11-6:libx11-6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11-6:libx11_6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11-6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11_6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_6:2\\:1.6.2-3:*:*:*:*:*:*:*"],"name":"libx11-6","purl":"pkg:deb/debian/libx11-6@2%3A1.6.2-3?arch=amd64&distro=debian-8.5&upstream=libx11","type":"deb","version":"2:1.6.2-3","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-6/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libx11-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-3+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14599","versionConstraint":"< 2:1.6.2-3+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libx11","version":"2:1.6.2-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14599","fix":{"state":"fixed","versions":["2:1.6.2-3+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.6.2-3+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14599","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14599","date":"2026-10-10","epss":0.04799,"percentile":0.91733}],"risk":3.5992499999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14599"},"relatedVulnerabilities":[{"id":"CVE-2018-14599","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14599","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14599","date":"2026-10-10","epss":0.04799,"percentile":0.91733}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/21/6","http://www.securityfocus.com/bid/105177","http://www.securitytracker.com/id/1041543","https://access.redhat.com/errata/RHSA-2019:2079","https://bugzilla.suse.com/show_bug.cgi?id=1102062","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=b469da1430cdcee06e31c6251b83aede072a1ff0","https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGARUV66TS5OOSLR5A76BUB7SDV6GO4F/","https://lists.x.org/archives/xorg-announce/2018-August/002916.html","https://security.gentoo.org/glsa/201811-01","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14599","description":"An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact."}]},{"artifact":{"id":"ad2e7a145e934793","cpes":["cpe:2.3:a:libx11-data:libx11-data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11-data:libx11_data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11-data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11_data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_data:2\\:1.6.2-3:*:*:*:*:*:*:*"],"name":"libx11-data","purl":"pkg:deb/debian/libx11-data@2%3A1.6.2-3?arch=all&distro=debian-8.5&upstream=libx11","type":"deb","version":"2:1.6.2-3","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-data/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libx11-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-data.list"}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-3+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14599","versionConstraint":"< 2:1.6.2-3+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libx11","version":"2:1.6.2-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14599","fix":{"state":"fixed","versions":["2:1.6.2-3+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.6.2-3+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14599","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14599","date":"2026-10-10","epss":0.04799,"percentile":0.91733}],"risk":3.5992499999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14599"},"relatedVulnerabilities":[{"id":"CVE-2018-14599","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14599","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14599","date":"2026-10-10","epss":0.04799,"percentile":0.91733}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/21/6","http://www.securityfocus.com/bid/105177","http://www.securitytracker.com/id/1041543","https://access.redhat.com/errata/RHSA-2019:2079","https://bugzilla.suse.com/show_bug.cgi?id=1102062","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=b469da1430cdcee06e31c6251b83aede072a1ff0","https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGARUV66TS5OOSLR5A76BUB7SDV6GO4F/","https://lists.x.org/archives/xorg-announce/2018-August/002916.html","https://security.gentoo.org/glsa/201811-01","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14599","description":"An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact."}]},{"artifact":{"id":"186b3e415d3e4868","cpes":["cpe:2.3:a:libx11-xcb1:libx11-xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11-xcb1:libx11_xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11-xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11_xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*"],"name":"libx11-xcb1","purl":"pkg:deb/debian/libx11-xcb1@2%3A1.6.2-3?arch=amd64&distro=debian-8.5&upstream=libx11","type":"deb","version":"2:1.6.2-3","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-xcb1/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libx11-xcb1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-xcb1:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-xcb1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-3+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14599","versionConstraint":"< 2:1.6.2-3+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libx11","version":"2:1.6.2-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-14599","fix":{"state":"fixed","versions":["2:1.6.2-3+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.6.2-3+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14599","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14599","date":"2026-10-10","epss":0.04799,"percentile":0.91733}],"risk":3.5992499999999996,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-14599"},"relatedVulnerabilities":[{"id":"CVE-2018-14599","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14599","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14599","date":"2026-10-10","epss":0.04799,"percentile":0.91733}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/21/6","http://www.securityfocus.com/bid/105177","http://www.securitytracker.com/id/1041543","https://access.redhat.com/errata/RHSA-2019:2079","https://bugzilla.suse.com/show_bug.cgi?id=1102062","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=b469da1430cdcee06e31c6251b83aede072a1ff0","https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGARUV66TS5OOSLR5A76BUB7SDV6GO4F/","https://lists.x.org/archives/xorg-announce/2018-August/002916.html","https://security.gentoo.org/glsa/201811-01","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14599","description":"An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-2~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-3149","versionConstraint":"< 7u181-2.6.14-2~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-3149","fix":{"state":"fixed","versions":["7u181-2.6.14-2~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u181-2.6.14-2~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-3149","date":"2026-10-10","epss":0.07156,"percentile":0.94136}],"risk":3.578,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-3149"},"relatedVulnerabilities":[{"id":"CVE-2018-3149","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3149","date":"2026-10-10","epss":0.07156,"percentile":0.94136}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/105608","http://www.securitytracker.com/id/1041889","https://access.redhat.com/errata/RHSA-2018:2942","https://access.redhat.com/errata/RHSA-2018:2943","https://access.redhat.com/errata/RHSA-2018:3000","https://access.redhat.com/errata/RHSA-2018:3001","https://access.redhat.com/errata/RHSA-2018:3002","https://access.redhat.com/errata/RHSA-2018:3003","https://access.redhat.com/errata/RHSA-2018:3007","https://access.redhat.com/errata/RHSA-2018:3008","https://access.redhat.com/errata/RHSA-2018:3350","https://access.redhat.com/errata/RHSA-2018:3409","https://access.redhat.com/errata/RHSA-2018:3521","https://access.redhat.com/errata/RHSA-2018:3533","https://access.redhat.com/errata/RHSA-2018:3534","https://access.redhat.com/errata/RHSA-2018:3671","https://access.redhat.com/errata/RHSA-2018:3672","https://access.redhat.com/errata/RHSA-2018:3779","https://access.redhat.com/errata/RHSA-2018:3852","https://lists.debian.org/debian-lts-announce/2018/11/msg00026.html","https://security.gentoo.org/glsa/201908-10","https://security.netapp.com/advisory/ntap-20181018-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03952en_us","https://usn.ubuntu.com/3804-1/","https://usn.ubuntu.com/3824-1/","https://www.debian.org/security/2018/dsa-4326"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-3149","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u201, 7u191, 8u182 and 11; Java SE Embedded: 8u181; JRockit: R28.3.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g. code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."}]},{"artifact":{"id":"2bd119a618d0f73c","cpes":["cpe:2.3:a:apache:sshd-core:0.14.1-atlassian-01:*:*:*:*:*:*:*","cpe:2.3:a:apache:sshd_core:0.14.1-atlassian-01:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:0.14.1-atlassian-01:*:*:*:*:*:*:*","cpe:2.3:a:apache:sshd:0.14.1-atlassian-01:*:*:*:*:*:*:*"],"name":"sshd-core","purl":"pkg:maven/org.apache.sshd/sshd-core@0.14.1-atlassian-01","type":"java-archive","version":"0.14.1-atlassian-01","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"org.apache.sshd","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:stash-ssh-3.11.4.jar:META-INF/lib/sshd-core-0.14.1-atlassian-01.jar","manifestName":"","pomArtifactID":"sshd-core","archiveDigests":[{"value":"6d339f205356a47194313b608bc05badfcba7fb6","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:stash-ssh-3.11.4.jar:META-INF/lib/sshd-core-0.14.1-atlassian-01.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-fhw8-8j55-vwgq","versionConstraint":"<2.1.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.sshd:sshd-core","version":"0.14.1-atlassian-01"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-fhw8-8j55-vwgq","fix":{"state":"fixed","versions":["2.9.2"],"available":[{"date":"2023-08-19","kind":"first-observed","version":"2.9.2"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45047","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-45047","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-45047","date":"2026-10-10","epss":0.03792,"percentile":0.89728}],"risk":3.5644800000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-45047","https://www.mail-archive.com/dev@mina.apache.org/msg39312.html","https://github.com/apache/mina-sshd/commit/03238d51586f6b3c0bdbb1a23cf16799344d6c32","https://github.com/apache/mina-sshd/commit/5a8fe830b2a2308a2b24ac8115a391af477f64f5","https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-fhw8-8j55-vwgq","description":"Unsafe deserialization in Apache MINA SSHD"},"relatedVulnerabilities":[{"id":"CVE-2022-45047","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-45047","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2022-45047","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-45047","date":"2026-10-10","epss":0.03792,"percentile":0.89728}],"urls":["https://security.netapp.com/advisory/ntap-20240216-0008/","https://www.mail-archive.com/dev%40mina.apache.org/msg39312.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-45047","description":"Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD can choose for loading the host keys of an SSH server."}]},{"artifact":{"id":"d91ce551dcf6c33f","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-10","epss":0.04731,"percentile":0.9163}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-10","epss":0.04731,"percentile":0.9163}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"495e1452a66e5099","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-10","epss":0.04731,"percentile":0.9163}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-10","epss":0.04731,"percentile":0.9163}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"6dec8d97d34362ed","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-9169","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-10","epss":0.04731,"percentile":0.9163}],"risk":3.54825,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9169"},"relatedVulnerabilities":[{"id":"CVE-2019-9169","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9169","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-9169","date":"2026-10-10","epss":0.04731,"percentile":0.9163}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://security.gentoo.org/glsa/202006-04","https://security.netapp.com/advisory/ntap-20190315-0002/","https://sourceware.org/bugzilla/show_bug.cgi?id=24114","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9","https://support.f5.com/csp/article/K54823184","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9169","description":"In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match."}]},{"artifact":{"id":"d4a4e53150a9623c","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.17.2-1.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.17.2-1.1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=nss","type":"deb","version":"2:3.17.2-1.1+deb8u2","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5461","versionConstraint":"< 2:3.26-1+debu8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"nss","version":"2:3.17.2-1.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-5461","fix":{"state":"fixed","versions":["2:3.26-1+debu8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5461","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5461","date":"2026-10-10","epss":0.04703,"percentile":0.9159}],"risk":3.52725,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3872-1","link":"https://security-tracker.debian.org/tracker/DSA-3872-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-5461"},"relatedVulnerabilities":[{"id":"CVE-2017-5461","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5461","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5461","date":"2026-10-10","epss":0.04703,"percentile":0.9159}],"urls":["http://www.debian.org/security/2017/dsa-3831","http://www.debian.org/security/2017/dsa-3872","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/98050","http://www.securitytracker.com/id/1038320","https://access.redhat.com/errata/RHSA-2017:1100","https://access.redhat.com/errata/RHSA-2017:1101","https://access.redhat.com/errata/RHSA-2017:1102","https://access.redhat.com/errata/RHSA-2017:1103","https://bugzilla.mozilla.org/show_bug.cgi?id=1344380","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21.4_release_notes","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.28.4_release_notes","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.29.5_release_notes","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.30.1_release_notes","https://security.gentoo.org/glsa/201705-04","https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5461","https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/#CVE-2017-5461","https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/#CVE-2017-5461","https://www.mozilla.org/en-US/security/advisories/mfsa2017-13/#CVE-2017-5461","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5461","description":"Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations."}]},{"artifact":{"id":"0f635d09c0b08425","cpes":["cpe:2.3:a:libglib2.0-0:libglib2.0-0:2.42.1-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0-0:libglib2.0_0:2.42.1-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0-0:2.42.1-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_0:libglib2.0_0:2.42.1-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0-0:2.42.1-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0_0:2.42.1-1\\+b1:*:*:*:*:*:*:*"],"name":"libglib2.0-0","purl":"pkg:deb/debian/libglib2.0-0@2.42.1-1%2Bb1?arch=amd64&distro=debian-8.5&upstream=glib2.0%402.42.1-1","type":"deb","version":"2.42.1-1+b1","language":"","licenses":["sha256:fba5358de01b6b99d385f588714b3b7f64be7074710e4d4152bc3a05dfef1789"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libglib2.0-0/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libglib2.0-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libglib2.0-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glib2.0","version":"2.42.1-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.42.1-1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16428","versionConstraint":"< 2.42.1-1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glib2.0","version":"2.42.1-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16428","fix":{"state":"fixed","versions":["2.42.1-1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.42.1-1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16428","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16428","date":"2026-10-10","epss":0.04693,"percentile":0.91574}],"risk":3.51975,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16428"},"relatedVulnerabilities":[{"id":"CVE-2018-16428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16428","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16428","date":"2026-10-10","epss":0.04693,"percentile":0.91574}],"urls":["http://www.openwall.com/lists/oss-security/2020/02/14/3","http://www.securityfocus.com/bid/105210","https://gitlab.gnome.org/GNOME/glib/commit/fccef3cc822af74699cca84cd202719ae61ca3b9","https://gitlab.gnome.org/GNOME/glib/issues/1364","https://lists.debian.org/debian-lts-announce/2019/07/msg00029.html","https://usn.ubuntu.com/3767-1/","https://usn.ubuntu.com/3767-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16428","description":"In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference."}]},{"artifact":{"id":"786664a360797881","cpes":["cpe:2.3:a:libglib2.0-data:libglib2.0-data:2.42.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0-data:libglib2.0_data:2.42.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_data:libglib2.0-data:2.42.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0_data:libglib2.0_data:2.42.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0-data:2.42.1-1:*:*:*:*:*:*:*","cpe:2.3:a:libglib2.0:libglib2.0_data:2.42.1-1:*:*:*:*:*:*:*"],"name":"libglib2.0-data","purl":"pkg:deb/debian/libglib2.0-data@2.42.1-1?arch=all&distro=debian-8.5&upstream=glib2.0","type":"deb","version":"2.42.1-1","language":"","licenses":["sha256:fba5358de01b6b99d385f588714b3b7f64be7074710e4d4152bc3a05dfef1789"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libglib2.0-data/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libglib2.0-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libglib2.0-data.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libglib2.0-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libglib2.0-data.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libglib2.0-data.list"},{"path":"/var/lib/dpkg/info/libglib2.0-data.preinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libglib2.0-data.preinst"}],"upstreams":[{"name":"glib2.0"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.42.1-1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16428","versionConstraint":"< 2.42.1-1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glib2.0","version":"2.42.1-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16428","fix":{"state":"fixed","versions":["2.42.1-1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.42.1-1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16428","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16428","date":"2026-10-10","epss":0.04693,"percentile":0.91574}],"risk":3.51975,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16428"},"relatedVulnerabilities":[{"id":"CVE-2018-16428","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16428","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16428","date":"2026-10-10","epss":0.04693,"percentile":0.91574}],"urls":["http://www.openwall.com/lists/oss-security/2020/02/14/3","http://www.securityfocus.com/bid/105210","https://gitlab.gnome.org/GNOME/glib/commit/fccef3cc822af74699cca84cd202719ae61ca3b9","https://gitlab.gnome.org/GNOME/glib/issues/1364","https://lists.debian.org/debian-lts-announce/2019/07/msg00029.html","https://usn.ubuntu.com/3767-1/","https://usn.ubuntu.com/3767-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16428","description":"In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference."}]},{"artifact":{"id":"d91ce551dcf6c33f","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-10","epss":0.04689,"percentile":0.91567}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-10","epss":0.04689,"percentile":0.91567}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"495e1452a66e5099","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-10","epss":0.04689,"percentile":0.91567}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-10","epss":0.04689,"percentile":0.91567}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"6dec8d97d34362ed","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6485","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-6485","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-10","epss":0.04689,"percentile":0.91567}],"risk":3.5167500000000005,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-6485"},"relatedVulnerabilities":[{"id":"CVE-2018-6485","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6485","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-6485","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6485","date":"2026-10-10","epss":0.04689,"percentile":0.91567}],"urls":["http://bugs.debian.org/878159","http://www.securityfocus.com/bid/102912","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190404-0003/","https://sourceware.org/bugzilla/show_bug.cgi?id=22343","https://usn.ubuntu.com/4218-1/","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6485","description":"An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-8622","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8622","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8622","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8622","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8622","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8622","date":"2026-10-10","epss":0.0467,"percentile":0.91543}],"risk":3.5025,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8622"},"relatedVulnerabilities":[{"id":"CVE-2016-8622","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8622","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8622","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8622","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8622","date":"2026-10-10","epss":0.0467,"percentile":0.91543}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94105","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8622","https://curl.haxx.se/docs/adv_20161102H.html","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8622","description":"The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8622","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8622","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8622","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8622","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8622","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8622","date":"2026-10-10","epss":0.0467,"percentile":0.91543}],"risk":3.5025,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8622"},"relatedVulnerabilities":[{"id":"CVE-2016-8622","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8622","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8622","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8622","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8622","date":"2026-10-10","epss":0.0467,"percentile":0.91543}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94105","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8622","https://curl.haxx.se/docs/adv_20161102H.html","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8622","description":"The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8622","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8622","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8622","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8622","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8622","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8622","date":"2026-10-10","epss":0.0467,"percentile":0.91543}],"risk":3.5025,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8622"},"relatedVulnerabilities":[{"id":"CVE-2016-8622","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8622","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8622","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8622","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8622","date":"2026-10-10","epss":0.0467,"percentile":0.91543}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94105","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8622","https://curl.haxx.se/docs/adv_20161102H.html","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8622","description":"The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-8620","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8620","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8620","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8620","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-8620","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8620","date":"2026-10-10","epss":0.04667,"percentile":0.91535}],"risk":3.5002500000000007,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8620"},"relatedVulnerabilities":[{"id":"CVE-2016-8620","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8620","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8620","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-8620","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8620","date":"2026-10-10","epss":0.04667,"percentile":0.91535}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94102","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8620","https://curl.haxx.se/docs/adv_20161102F.html","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8620","description":"The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8620","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8620","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8620","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8620","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-8620","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8620","date":"2026-10-10","epss":0.04667,"percentile":0.91535}],"risk":3.5002500000000007,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8620"},"relatedVulnerabilities":[{"id":"CVE-2016-8620","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8620","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8620","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-8620","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8620","date":"2026-10-10","epss":0.04667,"percentile":0.91535}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94102","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8620","https://curl.haxx.se/docs/adv_20161102F.html","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8620","description":"The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8620","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8620","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8620","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8620","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-8620","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8620","date":"2026-10-10","epss":0.04667,"percentile":0.91535}],"risk":3.5002500000000007,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8620"},"relatedVulnerabilities":[{"id":"CVE-2016-8620","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8620","cwe":"CWE-120","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8620","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-8620","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8620","date":"2026-10-10","epss":0.04667,"percentile":0.91535}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94102","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8620","https://curl.haxx.se/docs/adv_20161102F.html","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8620","description":"The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input."}]},{"artifact":{"id":"db8ea562e46a3772","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-2520","versionConstraint":"< 3.8.7.1-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-2520","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-2520","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-2520","date":"2026-10-10","epss":0.04643,"percentile":0.91501}],"risk":3.48225,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-2520"},"relatedVulnerabilities":[{"id":"CVE-2017-2520","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-2520","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-2520","date":"2026-10-10","epss":0.04643,"percentile":0.91501}],"urls":["http://www.securityfocus.com/bid/98468","http://www.securitytracker.com/id/1038484","https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html","https://support.apple.com/HT207797","https://support.apple.com/HT207798","https://support.apple.com/HT207800","https://support.apple.com/HT207801","https://usn.ubuntu.com/4019-1/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-2520","description":"An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the \"SQLite\" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted SQL statement."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u171-2.6.13-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2603","versionConstraint":"< 7u171-2.6.13-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-2603","fix":{"state":"fixed","versions":["7u171-2.6.13-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u171-2.6.13-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2603","date":"2026-10-10","epss":0.06905,"percentile":0.93936}],"risk":3.4525,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4166-1","link":"https://security-tracker.debian.org/tracker/DSA-4166-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-2603"},"relatedVulnerabilities":[{"id":"CVE-2018-2603","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2603","date":"2026-10-10","epss":0.06905,"percentile":0.93936}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.securityfocus.com/bid/102625","http://www.securitytracker.com/id/1040203","https://access.redhat.com/errata/RHSA-2018:0095","https://access.redhat.com/errata/RHSA-2018:0099","https://access.redhat.com/errata/RHSA-2018:0100","https://access.redhat.com/errata/RHSA-2018:0115","https://access.redhat.com/errata/RHSA-2018:0349","https://access.redhat.com/errata/RHSA-2018:0351","https://access.redhat.com/errata/RHSA-2018:0352","https://access.redhat.com/errata/RHSA-2018:0458","https://access.redhat.com/errata/RHSA-2018:0521","https://access.redhat.com/errata/RHSA-2018:1463","https://access.redhat.com/errata/RHSA-2018:1812","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2018/04/msg00003.html","https://security.netapp.com/advisory/ntap-20180117-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03911en_us","https://usn.ubuntu.com/3613-1/","https://usn.ubuntu.com/3614-1/","https://www.debian.org/security/2018/dsa-4144","https://www.debian.org/security/2018/dsa-4166"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2603","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-2~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-3214","versionConstraint":"< 7u181-2.6.14-2~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-3214","fix":{"state":"fixed","versions":["7u181-2.6.14-2~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u181-2.6.14-2~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-3214","date":"2026-10-10","epss":0.06868,"percentile":0.93903}],"risk":3.434,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-3214"},"relatedVulnerabilities":[{"id":"CVE-2018-3214","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3214","date":"2026-10-10","epss":0.06868,"percentile":0.93903}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/105615","http://www.securitytracker.com/id/1041889","https://access.redhat.com/errata/RHSA-2018:2942","https://access.redhat.com/errata/RHSA-2018:2943","https://access.redhat.com/errata/RHSA-2018:3000","https://access.redhat.com/errata/RHSA-2018:3001","https://access.redhat.com/errata/RHSA-2018:3002","https://access.redhat.com/errata/RHSA-2018:3003","https://access.redhat.com/errata/RHSA-2018:3007","https://access.redhat.com/errata/RHSA-2018:3008","https://access.redhat.com/errata/RHSA-2018:3350","https://access.redhat.com/errata/RHSA-2018:3409","https://access.redhat.com/errata/RHSA-2018:3533","https://access.redhat.com/errata/RHSA-2018:3534","https://access.redhat.com/errata/RHSA-2018:3671","https://access.redhat.com/errata/RHSA-2018:3672","https://access.redhat.com/errata/RHSA-2018:3779","https://access.redhat.com/errata/RHSA-2018:3852","https://lists.debian.org/debian-lts-announce/2018/11/msg00026.html","https://security.gentoo.org/glsa/201908-10","https://security.netapp.com/advisory/ntap-20181018-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03952en_us","https://usn.ubuntu.com/3804-1/","https://www.debian.org/security/2018/dsa-4326"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-3214","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Sound). Supported versions that are affected are Java SE: 6u201, 7u191 and 8u182; Java SE Embedded: 8u181; JRockit: R28.3.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g. through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"7a5def2d8ae90f36","cpes":["cpe:2.3:a:libidn11:libidn11:1.29-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libidn11","purl":"pkg:deb/debian/libidn11@1.29-1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=libidn","type":"deb","version":"1.29-1+deb8u1","language":"","licenses":["GAP","GFDL-1.3","GFDL-1.3+","GPL-2","GPL-3","GPL-3+","LGPL-2","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libidn11/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libidn11/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libidn11:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libidn11:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libidn"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.29-1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-8948","versionConstraint":"< 1.29-1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libidn","version":"1.29-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-8948","fix":{"state":"fixed","versions":["1.29-1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.29-1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-8948","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-8948","date":"2026-10-10","epss":0.06721,"percentile":0.93782}],"risk":3.3605000000000005,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3658-1","link":"https://security-tracker.debian.org/tracker/DSA-3658-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-8948"},"relatedVulnerabilities":[{"id":"CVE-2015-8948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-8948","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-8948","date":"2026-10-10","epss":0.06721,"percentile":0.93782}],"urls":["http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=570e68886c41c2e765e6218cb317d9a9a447a041","http://lists.opensuse.org/opensuse-updates/2016-08/msg00005.html","http://lists.opensuse.org/opensuse-updates/2016-08/msg00098.html","http://www.debian.org/security/2016/dsa-3658","http://www.openwall.com/lists/oss-security/2016/07/20/6","http://www.openwall.com/lists/oss-security/2016/07/21/4","http://www.securityfocus.com/bid/92070","http://www.ubuntu.com/usn/USN-3068-1","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-8948","description":"idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read."}]},{"artifact":{"id":"d4a4e53150a9623c","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.17.2-1.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.17.2-1.1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=nss","type":"deb","version":"2:3.17.2-1.1+deb8u2","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-17006","versionConstraint":"< 2:3.26-1+debu8u10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"nss","version":"2:3.17.2-1.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-17006","fix":{"state":"fixed","versions":["2:3.26-1+debu8u10"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u10"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17006","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17006","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17006","date":"2026-10-10","epss":0.03558,"percentile":0.89031}],"risk":3.34452,"urls":[],"severity":"Critical","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-17006"},"relatedVulnerabilities":[{"id":"CVE-2019-17006","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-17006","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-17006","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-17006","date":"2026-10-10","epss":0.03558,"percentile":0.89031}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1539788","https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes","https://security.netapp.com/advisory/ntap-20210129-0001/","https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-17006","description":"In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow."}]},{"artifact":{"id":"c6e6b72ebd423a03","cpes":["cpe:2.3:a:libx11-6:libx11-6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11-6:libx11_6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11-6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11_6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_6:2\\:1.6.2-3:*:*:*:*:*:*:*"],"name":"libx11-6","purl":"pkg:deb/debian/libx11-6@2%3A1.6.2-3?arch=amd64&distro=debian-8.5&upstream=libx11","type":"deb","version":"2:1.6.2-3","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-6/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libx11-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-3+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7942","versionConstraint":"< 2:1.6.2-3+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libx11","version":"2:1.6.2-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7942","fix":{"state":"fixed","versions":["2:1.6.2-3+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.6.2-3+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7942","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-7942","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7942","date":"2026-10-10","epss":0.04459,"percentile":0.91209}],"risk":3.34425,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7942"},"relatedVulnerabilities":[{"id":"CVE-2016-7942","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7942","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-7942","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7942","date":"2026-10-10","epss":0.04459,"percentile":0.91209}],"urls":["http://www.openwall.com/lists/oss-security/2016/10/04/2","http://www.openwall.com/lists/oss-security/2016/10/04/4","http://www.securityfocus.com/bid/93363","http://www.securitytracker.com/id/1036945","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8ea762f94f4c942d898fdeb590a1630c83235c17","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMCVDXMFPXR7QGMKDG22WPPJCXH2X3L7/","https://lists.x.org/archives/xorg-announce/2016-October/002720.html","https://security.gentoo.org/glsa/201704-03","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7942","description":"The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations."}]},{"artifact":{"id":"c6e6b72ebd423a03","cpes":["cpe:2.3:a:libx11-6:libx11-6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11-6:libx11_6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11-6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_6:libx11_6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-6:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_6:2\\:1.6.2-3:*:*:*:*:*:*:*"],"name":"libx11-6","purl":"pkg:deb/debian/libx11-6@2%3A1.6.2-3?arch=amd64&distro=debian-8.5&upstream=libx11","type":"deb","version":"2:1.6.2-3","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-6/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libx11-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-3+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7943","versionConstraint":"< 2:1.6.2-3+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libx11","version":"2:1.6.2-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7943","fix":{"state":"fixed","versions":["2:1.6.2-3+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.6.2-3+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7943","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7943","date":"2026-10-10","epss":0.04459,"percentile":0.91209}],"risk":3.34425,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7943"},"relatedVulnerabilities":[{"id":"CVE-2016-7943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7943","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7943","date":"2026-10-10","epss":0.04459,"percentile":0.91209}],"urls":["http://www.openwall.com/lists/oss-security/2016/10/04/2","http://www.openwall.com/lists/oss-security/2016/10/04/4","http://www.securityfocus.com/bid/93362","http://www.securitytracker.com/id/1036945","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8c29f1607a31dac0911e45a0dd3d74173822b3c9","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMCVDXMFPXR7QGMKDG22WPPJCXH2X3L7/","https://lists.x.org/archives/xorg-announce/2016-October/002720.html","https://security.gentoo.org/glsa/201704-03","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7943","description":"The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write operations."}]},{"artifact":{"id":"ad2e7a145e934793","cpes":["cpe:2.3:a:libx11-data:libx11-data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11-data:libx11_data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11-data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11_data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_data:2\\:1.6.2-3:*:*:*:*:*:*:*"],"name":"libx11-data","purl":"pkg:deb/debian/libx11-data@2%3A1.6.2-3?arch=all&distro=debian-8.5&upstream=libx11","type":"deb","version":"2:1.6.2-3","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-data/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libx11-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-data.list"}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-3+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7942","versionConstraint":"< 2:1.6.2-3+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libx11","version":"2:1.6.2-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7942","fix":{"state":"fixed","versions":["2:1.6.2-3+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.6.2-3+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7942","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-7942","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7942","date":"2026-10-10","epss":0.04459,"percentile":0.91209}],"risk":3.34425,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7942"},"relatedVulnerabilities":[{"id":"CVE-2016-7942","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7942","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-7942","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7942","date":"2026-10-10","epss":0.04459,"percentile":0.91209}],"urls":["http://www.openwall.com/lists/oss-security/2016/10/04/2","http://www.openwall.com/lists/oss-security/2016/10/04/4","http://www.securityfocus.com/bid/93363","http://www.securitytracker.com/id/1036945","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8ea762f94f4c942d898fdeb590a1630c83235c17","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMCVDXMFPXR7QGMKDG22WPPJCXH2X3L7/","https://lists.x.org/archives/xorg-announce/2016-October/002720.html","https://security.gentoo.org/glsa/201704-03","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7942","description":"The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations."}]},{"artifact":{"id":"ad2e7a145e934793","cpes":["cpe:2.3:a:libx11-data:libx11-data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11-data:libx11_data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11-data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_data:libx11_data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-data:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_data:2\\:1.6.2-3:*:*:*:*:*:*:*"],"name":"libx11-data","purl":"pkg:deb/debian/libx11-data@2%3A1.6.2-3?arch=all&distro=debian-8.5&upstream=libx11","type":"deb","version":"2:1.6.2-3","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-data/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libx11-data/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-data.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-data.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-data.list"}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-3+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7943","versionConstraint":"< 2:1.6.2-3+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libx11","version":"2:1.6.2-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7943","fix":{"state":"fixed","versions":["2:1.6.2-3+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.6.2-3+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7943","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7943","date":"2026-10-10","epss":0.04459,"percentile":0.91209}],"risk":3.34425,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7943"},"relatedVulnerabilities":[{"id":"CVE-2016-7943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7943","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7943","date":"2026-10-10","epss":0.04459,"percentile":0.91209}],"urls":["http://www.openwall.com/lists/oss-security/2016/10/04/2","http://www.openwall.com/lists/oss-security/2016/10/04/4","http://www.securityfocus.com/bid/93362","http://www.securitytracker.com/id/1036945","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8c29f1607a31dac0911e45a0dd3d74173822b3c9","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMCVDXMFPXR7QGMKDG22WPPJCXH2X3L7/","https://lists.x.org/archives/xorg-announce/2016-October/002720.html","https://security.gentoo.org/glsa/201704-03","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7943","description":"The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write operations."}]},{"artifact":{"id":"186b3e415d3e4868","cpes":["cpe:2.3:a:libx11-xcb1:libx11-xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11-xcb1:libx11_xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11-xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11_xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*"],"name":"libx11-xcb1","purl":"pkg:deb/debian/libx11-xcb1@2%3A1.6.2-3?arch=amd64&distro=debian-8.5&upstream=libx11","type":"deb","version":"2:1.6.2-3","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-xcb1/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libx11-xcb1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-xcb1:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-xcb1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-3+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7942","versionConstraint":"< 2:1.6.2-3+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libx11","version":"2:1.6.2-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7942","fix":{"state":"fixed","versions":["2:1.6.2-3+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.6.2-3+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7942","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-7942","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7942","date":"2026-10-10","epss":0.04459,"percentile":0.91209}],"risk":3.34425,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7942"},"relatedVulnerabilities":[{"id":"CVE-2016-7942","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7942","cwe":"CWE-264","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-7942","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7942","date":"2026-10-10","epss":0.04459,"percentile":0.91209}],"urls":["http://www.openwall.com/lists/oss-security/2016/10/04/2","http://www.openwall.com/lists/oss-security/2016/10/04/4","http://www.securityfocus.com/bid/93363","http://www.securitytracker.com/id/1036945","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8ea762f94f4c942d898fdeb590a1630c83235c17","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMCVDXMFPXR7QGMKDG22WPPJCXH2X3L7/","https://lists.x.org/archives/xorg-announce/2016-October/002720.html","https://security.gentoo.org/glsa/201704-03","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7942","description":"The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geometry, which triggers out-of-bounds read operations."}]},{"artifact":{"id":"186b3e415d3e4868","cpes":["cpe:2.3:a:libx11-xcb1:libx11-xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11-xcb1:libx11_xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11-xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11_xcb1:libx11_xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11-xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*","cpe:2.3:a:libx11:libx11_xcb1:2\\:1.6.2-3:*:*:*:*:*:*:*"],"name":"libx11-xcb1","purl":"pkg:deb/debian/libx11-xcb1@2%3A1.6.2-3?arch=amd64&distro=debian-8.5&upstream=libx11","type":"deb","version":"2:1.6.2-3","language":"","licenses":["BSD-1-Clause","HPND","HPND-sell-variant","MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libx11-xcb1/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libx11-xcb1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libx11-xcb1:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libx11-xcb1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libx11"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:1.6.2-3+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7943","versionConstraint":"< 2:1.6.2-3+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libx11","version":"2:1.6.2-3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-7943","fix":{"state":"fixed","versions":["2:1.6.2-3+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:1.6.2-3+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7943","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7943","date":"2026-10-10","epss":0.04459,"percentile":0.91209}],"risk":3.34425,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-7943"},"relatedVulnerabilities":[{"id":"CVE-2016-7943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7943","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7943","date":"2026-10-10","epss":0.04459,"percentile":0.91209}],"urls":["http://www.openwall.com/lists/oss-security/2016/10/04/2","http://www.openwall.com/lists/oss-security/2016/10/04/4","http://www.securityfocus.com/bid/93362","http://www.securitytracker.com/id/1036945","https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8c29f1607a31dac0911e45a0dd3d74173822b3c9","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GMCVDXMFPXR7QGMKDG22WPPJCXH2X3L7/","https://lists.x.org/archives/xorg-announce/2016-October/002720.html","https://security.gentoo.org/glsa/201704-03","https://usn.ubuntu.com/3758-1/","https://usn.ubuntu.com/3758-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7943","description":"The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, which trigger out-of-bounds write operations."}]},{"artifact":{"id":"4a6fc25b02170f2a","cpes":["cpe:2.3:a:apache:httpclient:4.0:*:*:*:*:*:*:*"],"name":"httpclient","purl":"pkg:maven/org.apache.httpcomponents/httpclient@4.0","type":"java-archive","version":"4.0","language":"java","licenses":["Apache-2.0"],"metadata":{"pomGroupID":"org.apache.httpcomponents","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:httpclient-osgi-4.0.jar:httpclient-4.0.jar","manifestName":"","pomArtifactID":"httpclient","archiveDigests":[{"value":"a76d7fd8033d48b4c67b4ccf159abb080c1059b6","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:httpclient-osgi-4.0.jar:httpclient-4.0.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.1.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gw85-4gmf-m7rh","versionConstraint":">=4.0.0,<4.1.1 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.httpcomponents:httpclient","version":"4.0"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gw85-4gmf-m7rh","fix":{"state":"fixed","versions":["4.1.1"],"available":[{"date":"2022-07-14","kind":"first-observed","version":"4.1.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2011-1498","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-1498","date":"2026-10-10","epss":0.06685,"percentile":0.93747}],"risk":3.3425000000000002,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2011-1498","https://bugzilla.redhat.com/show_bug.cgi?id=709531","https://issues.apache.org/jira/browse/HTTPCLIENT-1061","http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061440.html","http://marc.info/?l=httpclient-users&m=129853896315461&w=2","http://marc.info/?l=httpclient-users&m=129856318011586&w=2","http://marc.info/?l=httpclient-users&m=129857589129183&w=2","http://marc.info/?l=httpclient-users&m=129858274406594&w=2","http://marc.info/?l=httpclient-users&m=129858299106950&w=2","http://openwall.com/lists/oss-security/2011/04/07/7","http://openwall.com/lists/oss-security/2011/04/08/1","http://securityreason.com/securityalert/8298","https://github.com/apache/httpcomponents-client/commit/a572756592c969affd0ce87885724e74839176fb"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gw85-4gmf-m7rh","description":"Exposure of Sensitive Information to an Unauthorized Actor in Apache HttpClient"},"relatedVulnerabilities":[{"id":"CVE-2011-1498","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-1498","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2011-1498","date":"2026-10-10","epss":0.06685,"percentile":0.93747}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061440.html","http://marc.info/?l=httpclient-users&m=129853896315461&w=2","http://marc.info/?l=httpclient-users&m=129856318011586&w=2","http://marc.info/?l=httpclient-users&m=129857589129183&w=2","http://marc.info/?l=httpclient-users&m=129858274406594&w=2","http://marc.info/?l=httpclient-users&m=129858299106950&w=2","http://openwall.com/lists/oss-security/2011/04/07/7","http://openwall.com/lists/oss-security/2011/04/08/1","http://securityreason.com/securityalert/8298","http://www.apache.org/dist/httpcomponents/httpclient/RELEASE_NOTES-4.1.x.txt","http://www.kb.cert.org/vuls/id/153049","http://www.securityfocus.com/bid/46974","https://bugzilla.redhat.com/show_bug.cgi?id=709531","https://issues.apache.org/jira/browse/HTTPCLIENT-1061"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-1498","description":"Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header."}]},{"artifact":{"id":"5edbbe9f0eaac947","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-6\\+deb8u3:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/debian/libexpat1@2.1.0-6%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=expat","type":"deb","version":"2.1.0-6+deb8u3","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0-6+deb8u6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-15903","versionConstraint":"< 2.1.0-6+deb8u6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"expat","version":"2.1.0-6+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-15903","fix":{"state":"fixed","versions":["2.1.0-6+deb8u6"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.1.0-6+deb8u6"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-15903","date":"2026-10-10","epss":0.06643,"percentile":0.93716}],"risk":3.3215000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-15903"},"relatedVulnerabilities":[{"id":"CVE-2019-15903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-15903","date":"2026-10-10","epss":0.06643,"percentile":0.93716}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html","http://seclists.org/fulldisclosure/2019/Dec/23","http://seclists.org/fulldisclosure/2019/Dec/26","http://seclists.org/fulldisclosure/2019/Dec/27","http://seclists.org/fulldisclosure/2019/Dec/30","https://access.redhat.com/errata/RHSA-2019:3210","https://access.redhat.com/errata/RHSA-2019:3237","https://access.redhat.com/errata/RHSA-2019:3756","https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43","https://github.com/libexpat/libexpat/issues/317","https://github.com/libexpat/libexpat/issues/342","https://github.com/libexpat/libexpat/pull/318","https://lists.debian.org/debian-lts-announce/2019/11/msg00006.html","https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/","https://seclists.org/bugtraq/2019/Dec/17","https://seclists.org/bugtraq/2019/Dec/21","https://seclists.org/bugtraq/2019/Dec/23","https://seclists.org/bugtraq/2019/Nov/1","https://seclists.org/bugtraq/2019/Nov/24","https://seclists.org/bugtraq/2019/Oct/29","https://seclists.org/bugtraq/2019/Sep/30","https://seclists.org/bugtraq/2019/Sep/37","https://security.gentoo.org/glsa/201911-08","https://security.netapp.com/advisory/ntap-20190926-0004/","https://support.apple.com/kb/HT210785","https://support.apple.com/kb/HT210788","https://support.apple.com/kb/HT210789","https://support.apple.com/kb/HT210790","https://support.apple.com/kb/HT210793","https://support.apple.com/kb/HT210794","https://support.apple.com/kb/HT210795","https://usn.ubuntu.com/4132-1/","https://usn.ubuntu.com/4132-2/","https://usn.ubuntu.com/4165-1/","https://usn.ubuntu.com/4202-1/","https://usn.ubuntu.com/4335-1/","https://www.debian.org/security/2019/dsa-4530","https://www.debian.org/security/2019/dsa-4549","https://www.debian.org/security/2019/dsa-4571","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.tenable.com/security/tns-2021-11"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-15903","description":"In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r695-7vr9-jgc2","versionConstraint":">=2.0.0,<2.9.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r695-7vr9-jgc2","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2021-12-10","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36187","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36187","date":"2026-10-10","epss":0.04237,"percentile":0.90789}],"risk":3.3048599999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36187","https://github.com/FasterXML/jackson-databind/issues/2997","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/3e8fa3beea49ea62109df9e643c9cb678dabdde1"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r695-7vr9-jgc2","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36187","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36187","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36187","date":"2026-10-10","epss":0.04237,"percentile":0.90789}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2997","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36187","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r695-7vr9-jgc2","versionConstraint":">=2.0.0,<2.9.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r695-7vr9-jgc2","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2021-12-10","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36187","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36187","date":"2026-10-10","epss":0.04237,"percentile":0.90789}],"risk":3.3048599999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36187","https://github.com/FasterXML/jackson-databind/issues/2997","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/3e8fa3beea49ea62109df9e643c9cb678dabdde1"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r695-7vr9-jgc2","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36187","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36187","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36187","date":"2026-10-10","epss":0.04237,"percentile":0.90789}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2997","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36187","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8w26-6f25-cm9x","versionConstraint":">=2.0.0,<2.9.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8w26-6f25-cm9x","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2021-12-10","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36185","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36185","date":"2026-10-10","epss":0.04237,"percentile":0.90788}],"risk":3.3048599999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36185","https://github.com/FasterXML/jackson-databind/issues/2998","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/567194c53ae91f0a14dc27239afb739b1c10448a"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8w26-6f25-cm9x","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36185","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36185","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36185","date":"2026-10-10","epss":0.04237,"percentile":0.90788}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2998","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36185","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v585-23hc-c647","versionConstraint":">=2.0.0,<2.9.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v585-23hc-c647","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2021-11-30","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36186","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36186","date":"2026-10-10","epss":0.04237,"percentile":0.90788}],"risk":3.3048599999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36186","https://github.com/FasterXML/jackson-databind/issues/2997","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/3e8fa3beea49ea62109df9e643c9cb678dabdde1"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v585-23hc-c647","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36186","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36186","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36186","date":"2026-10-10","epss":0.04237,"percentile":0.90788}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2997","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36186","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8w26-6f25-cm9x","versionConstraint":">=2.0.0,<2.9.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8w26-6f25-cm9x","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2021-12-10","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36185","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36185","date":"2026-10-10","epss":0.04237,"percentile":0.90788}],"risk":3.3048599999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36185","https://github.com/FasterXML/jackson-databind/issues/2998","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/567194c53ae91f0a14dc27239afb739b1c10448a"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8w26-6f25-cm9x","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36185","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36185","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36185","date":"2026-10-10","epss":0.04237,"percentile":0.90788}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2998","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36185","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-v585-23hc-c647","versionConstraint":">=2.0.0,<2.9.10.8 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-v585-23hc-c647","fix":{"state":"fixed","versions":["2.9.10.8"],"available":[{"date":"2021-11-30","kind":"first-observed","version":"2.9.10.8"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36186","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36186","date":"2026-10-10","epss":0.04237,"percentile":0.90788}],"risk":3.3048599999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36186","https://github.com/FasterXML/jackson-databind/issues/2997","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/3e8fa3beea49ea62109df9e643c9cb678dabdde1"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-v585-23hc-c647","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36186","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36186","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36186","date":"2026-10-10","epss":0.04237,"percentile":0.90788}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2997","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36186","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000007","versionConstraint":"< 7.38.0-4+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000007","fix":{"state":"fixed","versions":["7.38.0-4+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u9"}]},"cvss":[],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-10","epss":0.06578,"percentile":0.93674}],"risk":3.289,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4098-1","link":"https://security-tracker.debian.org/tracker/DSA-4098-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000007"},"relatedVulnerabilities":[{"id":"CVE-2018-1000007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-10","epss":0.06578,"percentile":0.93674}],"urls":["http://www.openwall.com/lists/oss-security/2022/04/27/4","http://www.securitytracker.com/id/1040274","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b3bf.html","https://lists.debian.org/debian-lts-announce/2018/01/msg00038.html","https://usn.ubuntu.com/3554-1/","https://usn.ubuntu.com/3554-2/","https://www.debian.org/security/2018/dsa-4098","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000007","versionConstraint":"< 7.38.0-4+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000007","fix":{"state":"fixed","versions":["7.38.0-4+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u9"}]},"cvss":[],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-10","epss":0.06578,"percentile":0.93674}],"risk":3.289,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4098-1","link":"https://security-tracker.debian.org/tracker/DSA-4098-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000007"},"relatedVulnerabilities":[{"id":"CVE-2018-1000007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-10","epss":0.06578,"percentile":0.93674}],"urls":["http://www.openwall.com/lists/oss-security/2022/04/27/4","http://www.securitytracker.com/id/1040274","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b3bf.html","https://lists.debian.org/debian-lts-announce/2018/01/msg00038.html","https://usn.ubuntu.com/3554-1/","https://usn.ubuntu.com/3554-2/","https://www.debian.org/security/2018/dsa-4098","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000007","versionConstraint":"< 7.38.0-4+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000007","fix":{"state":"fixed","versions":["7.38.0-4+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u9"}]},"cvss":[],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-10","epss":0.06578,"percentile":0.93674}],"risk":3.289,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4098-1","link":"https://security-tracker.debian.org/tracker/DSA-4098-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000007"},"relatedVulnerabilities":[{"id":"CVE-2018-1000007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-10","epss":0.06578,"percentile":0.93674}],"urls":["http://www.openwall.com/lists/oss-security/2022/04/27/4","http://www.securitytracker.com/id/1040274","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b3bf.html","https://lists.debian.org/debian-lts-announce/2018/01/msg00038.html","https://usn.ubuntu.com/3554-1/","https://usn.ubuntu.com/3554-2/","https://www.debian.org/security/2018/dsa-4098","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request."}]},{"artifact":{"id":"30398275d6b98583","cpes":["cpe:2.3:a:libfreetype6:libfreetype6:2.5.2-3\\+deb8u1:*:*:*:*:*:*:*"],"name":"libfreetype6","purl":"pkg:deb/debian/libfreetype6@2.5.2-3%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=freetype","type":"deb","version":"2.5.2-3+deb8u1","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","Catharon-OSL","FTL","GPL-2","GPL-2+","GZip","OpenGroup-BSD-like"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libfreetype6/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libfreetype6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libfreetype6:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libfreetype6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"freetype"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.5.2-3+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8105","versionConstraint":"< 2.5.2-3+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"freetype","version":"2.5.2-3+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8105","fix":{"state":"fixed","versions":["2.5.2-3+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.5.2-3+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8105","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8105","date":"2026-10-10","epss":0.04358,"percentile":0.91005}],"risk":3.2685,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3839-1","link":"https://security-tracker.debian.org/tracker/DSA-3839-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8105"},"relatedVulnerabilities":[{"id":"CVE-2017-8105","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8105","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8105","date":"2026-10-10","epss":0.04358,"percentile":0.91005}],"urls":["http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f958c48ee431bef8d4d466b40c9cb2d4dbcb7791","http://www.debian.org/security/2017/dsa-3839","http://www.securityfocus.com/bid/99093","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=935","https://security.gentoo.org/glsa/201706-14","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8105","description":"FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2796","versionConstraint":"< 7u181-2.6.14-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-2796","fix":{"state":"fixed","versions":["7u181-2.6.14-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u181-2.6.14-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2796","date":"2026-10-10","epss":0.06531,"percentile":0.93633}],"risk":3.2655000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4225-1","link":"https://security-tracker.debian.org/tracker/DSA-4225-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-2796"},"relatedVulnerabilities":[{"id":"CVE-2018-2796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2796","date":"2026-10-10","epss":0.06531,"percentile":0.93633}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103868","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2796","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"313fa3578fbafcd9","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u2:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"2.9.1+dfsg1-5+deb8u2","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-16931","versionConstraint":"< 2.9.1+dfsg1-5+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16931","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-16931","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16931","date":"2026-10-10","epss":0.04332,"percentile":0.90954}],"risk":3.2489999999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16931"},"relatedVulnerabilities":[{"id":"CVE-2017-16931","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16931","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-16931","date":"2026-10-10","epss":0.04332,"percentile":0.90954}],"urls":["http://xmlsoft.org/news.html","https://bugzilla.gnome.org/show_bug.cgi?id=766956","https://github.com/GNOME/libxml2/commit/e26630548e7d138d2c560844c43820b6767251e3","https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html","https://www.oracle.com//security-alerts/cpujul2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16931","description":"parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3858","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3858","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3858","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3858","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3858","date":"2026-10-10","epss":0.06448,"percentile":0.93565}],"risk":3.2239999999999998,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3858"},"relatedVulnerabilities":[{"id":"CVE-2019-3858","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3858","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3858","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3858","date":"2026-10-10","epss":0.06448,"percentile":0.93565}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html","http://www.openwall.com/lists/oss-security/2019/03/18/3","http://www.securityfocus.com/bid/107485","https://access.redhat.com/errata/RHSA-2019:2136","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3858","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/","https://seclists.org/bugtraq/2019/Apr/25","https://seclists.org/bugtraq/2019/Mar/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3858.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3858","description":"An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory."}]},{"artifact":{"id":"636d5dbdc8a9bee4","cpes":["cpe:2.3:a:libncurses5:libncurses5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncurses5","purl":"pkg:deb/debian/libncurses5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.5&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libncurses5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libncurses5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10685","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10685","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-10","epss":0.04257,"percentile":0.90826}],"risk":3.1927499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10685"},"relatedVulnerabilities":[{"id":"CVE-2017-10685","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-10","epss":0.04257,"percentile":0.90826}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464692","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10685","description":"In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"58463c1cc3a120f0","cpes":["cpe:2.3:a:libncursesw5:libncursesw5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libncursesw5","purl":"pkg:deb/debian/libncursesw5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.5&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libncursesw5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libncursesw5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10685","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10685","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-10","epss":0.04257,"percentile":0.90826}],"risk":3.1927499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10685"},"relatedVulnerabilities":[{"id":"CVE-2017-10685","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-10","epss":0.04257,"percentile":0.90826}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464692","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10685","description":"In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"09d5d8f682c38b75","cpes":["cpe:2.3:a:libtinfo5:libtinfo5:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"libtinfo5","purl":"pkg:deb/debian/libtinfo5@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.5&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo5/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libtinfo5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libtinfo5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10685","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10685","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-10","epss":0.04257,"percentile":0.90826}],"risk":3.1927499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10685"},"relatedVulnerabilities":[{"id":"CVE-2017-10685","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-10","epss":0.04257,"percentile":0.90826}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464692","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10685","description":"In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"6293c813c118596f","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:5.9\\+20140913-1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:5.9\\+20140913-1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/debian/ncurses-base@5.9%2B20140913-1?arch=all&distro=debian-8.5&upstream=ncurses","type":"deb","version":"5.9+20140913-1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10685","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10685","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-10","epss":0.04257,"percentile":0.90826}],"risk":3.1927499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10685"},"relatedVulnerabilities":[{"id":"CVE-2017-10685","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-10","epss":0.04257,"percentile":0.90826}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464692","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10685","description":"In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"3cc6082f3526cf55","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:5.9\\+20140913-1\\+b1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/debian/ncurses-bin@5.9%2B20140913-1%2Bb1?arch=amd64&distro=debian-8.5&upstream=ncurses%405.9%2B20140913-1","type":"deb","version":"5.9+20140913-1+b1","language":"","licenses":["sha256:2b5abfe0462d4c0d8d6ef3dc9c5fa06476dd7af54406be4b863581d333cb9892"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses","version":"5.9+20140913-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.9+20140913-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10685","versionConstraint":"< 5.9+20140913-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"ncurses","version":"5.9+20140913-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10685","fix":{"state":"fixed","versions":["5.9+20140913-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.9+20140913-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-10","epss":0.04257,"percentile":0.90826}],"risk":3.1927499999999998,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10685"},"relatedVulnerabilities":[{"id":"CVE-2017-10685","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10685","cwe":"CWE-134","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10685","date":"2026-10-10","epss":0.04257,"percentile":0.90826}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464692","https://security.gentoo.org/glsa/201804-13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10685","description":"In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-89qr-369f-5m5x","versionConstraint":">=2.0.0,<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-89qr-369f-5m5x","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36182","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36182","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36182","date":"2026-10-10","epss":0.04092,"percentile":0.90486}],"risk":3.19176,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36182","https://github.com/FasterXML/jackson-databind/issues/3004","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/3ded28aece694d0df39c9f0fa1ff385b14a8656b"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-89qr-369f-5m5x","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36182","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36182","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36182","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36182","date":"2026-10-10","epss":0.04092,"percentile":0.90486}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/3004","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36182","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c4j-34r4-xr8g","versionConstraint":">=2.0.0,<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8c4j-34r4-xr8g","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36180","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36180","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36180","date":"2026-10-10","epss":0.04092,"percentile":0.90486}],"risk":3.19176,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36180","https://github.com/FasterXML/jackson-databind/issues/3004","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/3ded28aece694d0df39c9f0fa1ff385b14a8656b"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c4j-34r4-xr8g","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36180","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36180","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36180","date":"2026-10-10","epss":0.04092,"percentile":0.90486}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/3004","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36180","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cvm9-fjm9-3572","versionConstraint":">=2.0.0,<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cvm9-fjm9-3572","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36181","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36181","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36181","date":"2026-10-10","epss":0.04092,"percentile":0.90486}],"risk":3.19176,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36181","https://github.com/FasterXML/jackson-databind/issues/3004","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/3ded28aece694d0df39c9f0fa1ff385b14a8656b"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cvm9-fjm9-3572","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36181","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36181","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36181","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36181","date":"2026-10-10","epss":0.04092,"percentile":0.90486}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/3004","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36181","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-89qr-369f-5m5x","versionConstraint":">=2.0.0,<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-89qr-369f-5m5x","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36182","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36182","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36182","date":"2026-10-10","epss":0.04092,"percentile":0.90486}],"risk":3.19176,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36182","https://github.com/FasterXML/jackson-databind/issues/3004","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/3ded28aece694d0df39c9f0fa1ff385b14a8656b"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-89qr-369f-5m5x","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36182","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36182","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36182","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36182","date":"2026-10-10","epss":0.04092,"percentile":0.90486}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/3004","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36182","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-8c4j-34r4-xr8g","versionConstraint":">=2.0.0,<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-8c4j-34r4-xr8g","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36180","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36180","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36180","date":"2026-10-10","epss":0.04092,"percentile":0.90486}],"risk":3.19176,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36180","https://github.com/FasterXML/jackson-databind/issues/3004","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/3ded28aece694d0df39c9f0fa1ff385b14a8656b"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8c4j-34r4-xr8g","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36180","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36180","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36180","date":"2026-10-10","epss":0.04092,"percentile":0.90486}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/3004","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36180","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-cvm9-fjm9-3572","versionConstraint":">=2.0.0,<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-cvm9-fjm9-3572","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36181","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36181","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36181","date":"2026-10-10","epss":0.04092,"percentile":0.90486}],"risk":3.19176,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36181","https://github.com/FasterXML/jackson-databind/issues/3004","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/3ded28aece694d0df39c9f0fa1ff385b14a8656b"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-cvm9-fjm9-3572","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36181","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36181","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-36181","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-36181","date":"2026-10-10","epss":0.04092,"percentile":0.90486}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/3004","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36181","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3859","versionConstraint":"< 1.4.3-4.1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3859","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-3859","date":"2026-10-10","epss":0.06275,"percentile":0.93416}],"risk":3.1375,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3859"},"relatedVulnerabilities":[{"id":"CVE-2019-3859","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3859","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-3859","date":"2026-10-10","epss":0.06275,"percentile":0.93416}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00102.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00103.html","http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html","http://www.openwall.com/lists/oss-security/2019/03/18/3","http://www.securityfocus.com/bid/107485","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3859","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.debian.org/debian-lts-announce/2019/04/msg00006.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/","https://seclists.org/bugtraq/2019/Apr/25","https://seclists.org/bugtraq/2019/Mar/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3859.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3859","description":"An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh2_packet_require and _libssh2_packet_requirev functions. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-8624","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8624","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8624","date":"2026-10-10","epss":0.06253,"percentile":0.93397}],"risk":3.1265,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8624"},"relatedVulnerabilities":[{"id":"CVE-2016-8624","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8624","date":"2026-10-10","epss":0.06253,"percentile":0.93397}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94103","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624","https://curl.haxx.se/docs/adv_20161102J.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5%40%3Ccommits.pulsar.apache.org%3E","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8624","description":"curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8624","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8624","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8624","date":"2026-10-10","epss":0.06253,"percentile":0.93397}],"risk":3.1265,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8624"},"relatedVulnerabilities":[{"id":"CVE-2016-8624","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8624","date":"2026-10-10","epss":0.06253,"percentile":0.93397}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94103","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624","https://curl.haxx.se/docs/adv_20161102J.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5%40%3Ccommits.pulsar.apache.org%3E","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8624","description":"curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8624","versionConstraint":"< 7.38.0-4+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-8624","fix":{"state":"fixed","versions":["7.38.0-4+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8624","date":"2026-10-10","epss":0.06253,"percentile":0.93397}],"risk":3.1265,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3705-1","link":"https://security-tracker.debian.org/tracker/DSA-3705-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-8624"},"relatedVulnerabilities":[{"id":"CVE-2016-8624","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8624","date":"2026-10-10","epss":0.06253,"percentile":0.93397}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94103","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624","https://curl.haxx.se/docs/adv_20161102J.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5%40%3Ccommits.pulsar.apache.org%3E","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8624","description":"curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u261-2.6.22-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-2803","versionConstraint":"< 7u261-2.6.22-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-2803","fix":{"state":"fixed","versions":["7u261-2.6.22-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u261-2.6.22-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2020-2803","date":"2026-10-10","epss":0.0623,"percentile":0.93376}],"risk":3.115,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-2803"},"relatedVulnerabilities":[{"id":"CVE-2020-2803","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-2803","date":"2026-10-10","epss":0.0623,"percentile":0.93376}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html","https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/","https://security.gentoo.org/glsa/202006-22","https://security.gentoo.org/glsa/202209-15","https://security.netapp.com/advisory/ntap-20200416-0004/","https://usn.ubuntu.com/4337-1/","https://www.debian.org/security/2020/dsa-4662","https://www.debian.org/security/2020/dsa-4668","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-2803","description":"Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-1000257","versionConstraint":"< 7.38.0-4+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000257","fix":{"state":"fixed","versions":["7.38.0-4+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-10","epss":0.06224,"percentile":0.93373}],"risk":3.1119999999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4007-1","link":"https://security-tracker.debian.org/tracker/DSA-4007-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000257"},"relatedVulnerabilities":[{"id":"CVE-2017-1000257","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-10","epss":0.06224,"percentile":0.93373}],"urls":["http://www.debian.org/security/2017/dsa-4007","http://www.securityfocus.com/bid/101519","http://www.securitytracker.com/id/1039644","https://access.redhat.com/errata/RHSA-2017:3263","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20171023.html","https://security.gentoo.org/glsa/201712-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000257","description":"An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000257","versionConstraint":"< 7.38.0-4+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000257","fix":{"state":"fixed","versions":["7.38.0-4+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-10","epss":0.06224,"percentile":0.93373}],"risk":3.1119999999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4007-1","link":"https://security-tracker.debian.org/tracker/DSA-4007-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000257"},"relatedVulnerabilities":[{"id":"CVE-2017-1000257","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-10","epss":0.06224,"percentile":0.93373}],"urls":["http://www.debian.org/security/2017/dsa-4007","http://www.securityfocus.com/bid/101519","http://www.securitytracker.com/id/1039644","https://access.redhat.com/errata/RHSA-2017:3263","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20171023.html","https://security.gentoo.org/glsa/201712-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000257","description":"An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000257","versionConstraint":"< 7.38.0-4+deb8u7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-1000257","fix":{"state":"fixed","versions":["7.38.0-4+deb8u7"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u7"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-10","epss":0.06224,"percentile":0.93373}],"risk":3.1119999999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4007-1","link":"https://security-tracker.debian.org/tracker/DSA-4007-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-1000257"},"relatedVulnerabilities":[{"id":"CVE-2017-1000257","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-10","epss":0.06224,"percentile":0.93373}],"urls":["http://www.debian.org/security/2017/dsa-4007","http://www.securityfocus.com/bid/101519","http://www.securitytracker.com/id/1039644","https://access.redhat.com/errata/RHSA-2017:3263","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20171023.html","https://security.gentoo.org/glsa/201712-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000257","description":"An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vfqx-33qm-g869","versionConstraint":"<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vfqx-33qm-g869","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36189","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36189","date":"2026-10-10","epss":0.03987,"percentile":0.90261}],"risk":3.1098600000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36189","https://github.com/FasterXML/jackson-databind/issues/2996","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/33d96c13fe18a2dad01b19ce195548c9acea9da4"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vfqx-33qm-g869","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36189","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36189","date":"2026-10-10","epss":0.03987,"percentile":0.90261}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2996","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36189","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.6.7.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vfqx-33qm-g869","versionConstraint":"<2.6.7.5 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-vfqx-33qm-g869","fix":{"state":"fixed","versions":["2.6.7.5"],"available":[{"date":"2023-09-15","kind":"first-observed","version":"2.6.7.5"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36189","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36189","date":"2026-10-10","epss":0.03987,"percentile":0.90261}],"risk":3.1098600000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-36189","https://github.com/FasterXML/jackson-databind/issues/2996","https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20210205-0005/","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://github.com/FasterXML/jackson-databind/commit/33d96c13fe18a2dad01b19ce195548c9acea9da4"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vfqx-33qm-g869","description":"Unsafe Deserialization in jackson-databind"},"relatedVulnerabilities":[{"id":"CVE-2020-36189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36189","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36189","date":"2026-10-10","epss":0.03987,"percentile":0.90261}],"urls":["https://cowtowncoder.medium.com/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://github.com/FasterXML/jackson-databind/issues/2996","https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html","https://security.netapp.com/advisory/ntap-20210205-0005/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36189","description":"FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource."}]},{"artifact":{"id":"57469482e26b9740","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12837","versionConstraint":"< 5.20.2-3+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12837","fix":{"state":"fixed","versions":["5.20.2-3+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-10","epss":0.06207,"percentile":0.93355}],"risk":3.1035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3982-1","link":"https://security-tracker.debian.org/tracker/DSA-3982-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12837"},"relatedVulnerabilities":[{"id":"CVE-2017-12837","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-10","epss":0.06207,"percentile":0.93355}],"urls":["http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100860","https://bugzilla.redhat.com/show_bug.cgi?id=1492091","https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131582","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12837","description":"Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier."}]},{"artifact":{"id":"71183f78a986047d","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12837","versionConstraint":"< 5.20.2-3+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12837","fix":{"state":"fixed","versions":["5.20.2-3+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-10","epss":0.06207,"percentile":0.93355}],"risk":3.1035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3982-1","link":"https://security-tracker.debian.org/tracker/DSA-3982-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12837"},"relatedVulnerabilities":[{"id":"CVE-2017-12837","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-10","epss":0.06207,"percentile":0.93355}],"urls":["http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100860","https://bugzilla.redhat.com/show_bug.cgi?id=1492091","https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131582","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12837","description":"Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier."}]},{"artifact":{"id":"16a442ba7a1a09d3","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u6?arch=all&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12837","versionConstraint":"< 5.20.2-3+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12837","fix":{"state":"fixed","versions":["5.20.2-3+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-10","epss":0.06207,"percentile":0.93355}],"risk":3.1035,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3982-1","link":"https://security-tracker.debian.org/tracker/DSA-3982-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12837"},"relatedVulnerabilities":[{"id":"CVE-2017-12837","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-10","epss":0.06207,"percentile":0.93355}],"urls":["http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100860","https://bugzilla.redhat.com/show_bug.cgi?id=1492091","https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131582","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12837","description":"Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier."}]},{"artifact":{"id":"fad235ec983b8ebe","cpes":["cpe:2.3:a:org.springframework:spring-web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework:spring_web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring-web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-web:spring_web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring-web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_web:spring_web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-web:4.1.6.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_web:4.1.6.RELEASE:*:*:*:*:*:*:*"],"name":"spring-web","purl":"pkg:maven/org.springframework/spring-web@4.1.6.RELEASE","type":"java-archive","version":"4.1.6.RELEASE","language":"java","licenses":["Apache-2.0","BSD-3-Clause"],"metadata":{"pomGroupID":"org.springframework","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-web-4.1.6.RELEASE.jar","manifestName":"","pomArtifactID":"spring-web","archiveDigests":[{"value":"960101b25d0ec6f45d550bf92c00de8c6a584e6a","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-web-4.1.6.RELEASE.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-web-4.1.6.RELEASE.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-ccgv-vj62-xf9h","versionConstraint":"<=5.2.25.RELEASE (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework:spring-web","version":"4.1.6.RELEASE"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-ccgv-vj62-xf9h","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22243","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22243","date":"2026-10-10","epss":0.03967,"percentile":0.90209}],"risk":3.09426,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-22243","https://spring.io/security/cve-2024-22243","https://github.com/spring-projects/spring-framework/blob/main/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java","https://security.netapp.com/advisory/ntap-20240524-0001","http://seclists.org/fulldisclosure/2024/Sep/24"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-ccgv-vj62-xf9h","description":"Spring Web vulnerable to Open Redirect or Server Side Request Forgery"},"relatedVulnerabilities":[{"id":"CVE-2024-22243","cvss":[{"type":"Secondary","source":"security@vmware.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-22243","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-22243","date":"2026-10-10","epss":0.03967,"percentile":0.90209}],"urls":["https://security.netapp.com/advisory/ntap-20240524-0001/","https://spring.io/security/cve-2024-22243","http://seclists.org/fulldisclosure/2024/Sep/24"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-22243","description":"Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a  open redirect https://cwe.mitre.org/data/definitions/601.html  attack or to a SSRF attack if the URL is used after passing validation checks."}]},{"artifact":{"id":"999754bfd5d89f7c","cpes":["cpe:2.3:a:libpcre3:libpcre3:2\\:8.35-3.3\\+deb8u4:*:*:*:*:*:*:*"],"name":"libpcre3","purl":"pkg:deb/debian/libpcre3@2%3A8.35-3.3%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=pcre3","type":"deb","version":"2:8.35-3.3+deb8u4","language":"","licenses":["sha256:ac9276490d2fa167442ae1aae33926514ad10c8886baa40046c5e367fccc5938"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre3/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libpcre3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-3217","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"pcre3","version":"2:8.35-3.3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2015-3217","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-3217","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3217","date":"2026-10-10","epss":0.06169,"percentile":0.93317}],"risk":3.0845000000000002,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2015-3217"},"relatedVulnerabilities":[{"id":"CVE-2015-3217","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-3217","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3217","date":"2026-10-10","epss":0.06169,"percentile":0.93317}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-1025.html","http://rhn.redhat.com/errata/RHSA-2016-2750.html","http://vcs.pcre.org/pcre?view=revision&revision=1566","http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886","http://www.openwall.com/lists/oss-security/2015/06/03/7","http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","http://www.securityfocus.com/bid/75018","https://access.redhat.com/errata/RHSA-2016:1132","https://bugs.exim.org/show_bug.cgi?id=1638","https://bugzilla.redhat.com/show_bug.cgi?id=1228283"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3217","description":"PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\\\.|([^\\\\\\\\W_])?)+)+$/."}]},{"artifact":{"id":"e09c6c2226f6c926","cpes":["cpe:2.3:a:com.hazelcast.osgi.Activator:hazelcast:3.4.2-atlassian-17:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,-inc-:hazelcast:3.4.2-atlassian-17:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast\\,_inc_:hazelcast:3.4.2-atlassian-17:*:*:*:*:*:*:*","cpe:2.3:a:com.hazelcast:hazelcast:3.4.2-atlassian-17:*:*:*:*:*:*:*","cpe:2.3:a:Activator:hazelcast:3.4.2-atlassian-17:*:*:*:*:*:*:*","cpe:2.3:a:hazelcast:hazelcast:3.4.2-atlassian-17:*:*:*:*:*:*:*","cpe:2.3:a:osgi:hazelcast:3.4.2-atlassian-17:*:*:*:*:*:*:*"],"name":"hazelcast","purl":"pkg:maven/com.hazelcast/hazelcast@3.4.2-atlassian-17","type":"java-archive","version":"3.4.2-atlassian-17","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"com.hazelcast","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/hazelcast-3.4.2-atlassian-17.jar","manifestName":"","pomArtifactID":"hazelcast","archiveDigests":[{"value":"8832c9e36526c39b2d62a05d83468f64249ff734","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/hazelcast-3.4.2-atlassian-17.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/hazelcast-3.4.2-atlassian-17.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"3.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jv65-pf7v-f7p8","versionConstraint":"<3.11 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.hazelcast:hazelcast","version":"3.4.2-atlassian-17"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jv65-pf7v-f7p8","fix":{"state":"fixed","versions":["3.11"],"available":[{"date":"2022-07-08","kind":"first-observed","version":"3.11"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10750","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10750","date":"2026-10-10","epss":0.03951,"percentile":0.90165}],"risk":3.08178,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-10750","https://github.com/hazelcast/hazelcast/issues/8024","https://github.com/hazelcast/hazelcast/pull/12230"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jv65-pf7v-f7p8","description":"Deserialization of Untrusted Data in Hazelcast"},"relatedVulnerabilities":[{"id":"CVE-2016-10750","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10750","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10750","date":"2026-10-10","epss":0.03951,"percentile":0.90165}],"urls":["https://access.redhat.com/errata/RHSA-2019:2413","https://github.com/hazelcast/hazelcast/issues/8024","https://github.com/hazelcast/hazelcast/pull/12230"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10750","description":"In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3856","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3856","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3856","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3856","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3856","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3856","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3856","date":"2026-10-10","epss":0.06131,"percentile":0.9328}],"risk":3.0655,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3856"},"relatedVulnerabilities":[{"id":"CVE-2019-3856","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3856","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3856","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3856","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3856","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3856","date":"2026-10-10","epss":0.06131,"percentile":0.9328}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","https://access.redhat.com/errata/RHSA-2019:0679","https://access.redhat.com/errata/RHSA-2019:1175","https://access.redhat.com/errata/RHSA-2019:1652","https://access.redhat.com/errata/RHSA-2019:1791","https://access.redhat.com/errata/RHSA-2019:1943","https://access.redhat.com/errata/RHSA-2019:2399","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3856","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://seclists.org/bugtraq/2019/Apr/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3856.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3856","description":"An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3857","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3857","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3857","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3857","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3857","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3857","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3857","date":"2026-10-10","epss":0.06131,"percentile":0.9328}],"risk":3.0655,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3857"},"relatedVulnerabilities":[{"id":"CVE-2019-3857","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3857","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3857","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3857","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-3857","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3857","date":"2026-10-10","epss":0.06131,"percentile":0.9328}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","https://access.redhat.com/errata/RHSA-2019:0679","https://access.redhat.com/errata/RHSA-2019:1175","https://access.redhat.com/errata/RHSA-2019:1652","https://access.redhat.com/errata/RHSA-2019:1791","https://access.redhat.com/errata/RHSA-2019:1943","https://access.redhat.com/errata/RHSA-2019:2399","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3857","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://seclists.org/bugtraq/2019/Apr/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3857.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3857","description":"An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server."}]},{"artifact":{"id":"f7fd350542a276b9","cpes":["cpe:2.3:a:libfcgi-perl:libfcgi-perl:0.77-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libfcgi-perl:libfcgi_perl:0.77-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libfcgi_perl:libfcgi-perl:0.77-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libfcgi_perl:libfcgi_perl:0.77-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libfcgi:libfcgi-perl:0.77-1\\+b1:*:*:*:*:*:*:*","cpe:2.3:a:libfcgi:libfcgi_perl:0.77-1\\+b1:*:*:*:*:*:*:*"],"name":"libfcgi-perl","purl":"pkg:deb/debian/libfcgi-perl@0.77-1%2Bb1?arch=amd64&distro=debian-8.5&upstream=libfcgi-perl%400.77-1","type":"deb","version":"0.77-1+b1","language":"","licenses":["PD","other"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libfcgi-perl/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libfcgi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libfcgi-perl.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libfcgi-perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libfcgi-perl.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libfcgi-perl.list"}],"upstreams":[{"name":"libfcgi-perl","version":"0.77-1"}]},"matchDetails":[{"fix":{"suggestedVersion":"0.77-1+deb8u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2012-6687","versionConstraint":"< 0.77-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libfcgi-perl","version":"0.77-1+b1"},"namespace":"debian:distro:debian:8"}},{"fix":{"suggestedVersion":"0.77-1+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2012-6687","versionConstraint":"< 0.77-1+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libfcgi-perl","version":"0.77-1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2012-6687","fix":{"state":"fixed","versions":["0.77-1+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"0.77-1+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2012-6687","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-6687","date":"2026-10-10","epss":0.06086,"percentile":0.93245}],"risk":3.0429999999999997,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2012-6687"},"relatedVulnerabilities":[{"id":"CVE-2012-6687","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-6687","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-6687","date":"2026-10-10","epss":0.06086,"percentile":0.93245}],"urls":["http://advisories.mageia.org/MGASA-2015-0184.html","http://www.openwall.com/lists/oss-security/2015/02/06/4","http://www.openwall.com/lists/oss-security/2015/02/07/4","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681591","https://bugs.launchpad.net/ubuntu/+source/libfcgi/+bug/933417","https://bugzilla.redhat.com/show_bug.cgi?id=1189958","https://exchange.xforce.ibmcloud.com/vulnerabilities/100696"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-6687","description":"FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number of connections."}]},{"artifact":{"id":"3f2f80ce378c7902","cpes":["cpe:2.3:a:apache:avro:1.7.7:*:*:*:*:*:*:*"],"name":"avro","purl":"pkg:maven/org.apache.avro/avro@1.7.7","type":"java-archive","version":"1.7.7","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.avro","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:org.apache.avro:avro","manifestName":"","pomArtifactID":"avro","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.11.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-r7pg-v2c8-mfg3","versionConstraint":"<1.11.4 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.avro:avro","version":"1.7.7"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-r7pg-v2c8-mfg3","fix":{"state":"fixed","versions":["1.11.4"],"available":[{"date":"2024-10-09","kind":"first-observed","version":"1.11.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47561","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-47561","date":"2026-10-10","epss":0.03256,"percentile":0.88035}],"risk":3.0199399999999996,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-47561","https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x","https://github.com/apache/avro/pull/2934","https://github.com/apache/avro/pull/2980","https://github.com/apache/avro/commit/8f89868d29272e3afea2ff8de8c85cb81a57d900","https://github.com/apache/avro/commit/f6b3bd7e50e6e09fedddb98c61558c022ba31285","https://issues.apache.org/jira/browse/AVRO-3985","https://thehackernews.com/2024/10/critical-apache-avro-sdk-flaw-allows.html","https://www.openwall.com/lists/oss-security/2024/10/03/1","https://security.netapp.com/advisory/ntap-20241011-0003","http://www.openwall.com/lists/oss-security/2024/10/03/1"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-r7pg-v2c8-mfg3","description":"Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)"},"relatedVulnerabilities":[{"id":"CVE-2024-47561","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security@apache.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-47561","cwe":"CWE-502","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2024-47561","date":"2026-10-10","epss":0.03256,"percentile":0.88035}],"urls":["https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x","http://www.openwall.com/lists/oss-security/2024/10/03/1","https://security.netapp.com/advisory/ntap-20241011-0003/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47561","description":"Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.\nUsers are recommended to upgrade to version 1.11.4  or 1.12.0, which fix this issue."}]},{"artifact":{"id":"c0d03103d3c905a6","cpes":["cpe:2.3:a:bash:bash:4.3-11\\+b1:*:*:*:*:*:*:*"],"name":"bash","purl":"pkg:deb/debian/bash@4.3-11%2Bb1?arch=amd64&distro=debian-8.5&upstream=bash%404.3-11","type":"deb","version":"4.3-11+b1","language":"","licenses":["sha256:da7a8d93abf1eccdeaf326642c8ce9ed760f3a973ca46f3f69b3cf755bb81ade"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bash/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/bash/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bash.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/bash.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bash.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/bash.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bash.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/bash.list"},{"path":"/var/lib/dpkg/info/bash.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/bash.postinst"},{"path":"/var/lib/dpkg/info/bash.postrm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/bash.postrm"},{"path":"/var/lib/dpkg/info/bash.preinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/bash.preinst"},{"path":"/var/lib/dpkg/info/bash.prerm","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/bash.prerm"}],"upstreams":[{"name":"bash","version":"4.3-11"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.3-11+deb8u1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-0634","versionConstraint":"< 4.3-11+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"bash","version":"4.3-11+b1"},"namespace":"debian:distro:debian:8"}},{"fix":{"suggestedVersion":"4.3-11+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-0634","versionConstraint":"< 4.3-11+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"bash","version":"4.3-11"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-0634","fix":{"state":"fixed","versions":["4.3-11+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"4.3-11+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-0634","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0634","date":"2026-10-10","epss":0.06019,"percentile":0.93175}],"risk":3.0095,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-0634"},"relatedVulnerabilities":[{"id":"CVE-2016-0634","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6,"impactScore":6.5,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-0634","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0634","date":"2026-10-10","epss":0.06019,"percentile":0.93175}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0725.html","http://www.openwall.com/lists/oss-security/2016/09/16/12","http://www.openwall.com/lists/oss-security/2016/09/16/8","http://www.openwall.com/lists/oss-security/2016/09/18/11","http://www.openwall.com/lists/oss-security/2016/09/19/7","http://www.openwall.com/lists/oss-security/2016/09/20/1","http://www.openwall.com/lists/oss-security/2016/09/27/9","http://www.openwall.com/lists/oss-security/2016/09/29/27","http://www.openwall.com/lists/oss-security/2016/10/07/6","http://www.openwall.com/lists/oss-security/2016/10/10/3","http://www.openwall.com/lists/oss-security/2016/10/10/4","http://www.securityfocus.com/bid/92999","https://access.redhat.com/errata/RHSA-2017:1931","https://bugzilla.redhat.com/show_bug.cgi?id=1377613","https://security.gentoo.org/glsa/201612-39"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-0634","description":"The expansion of '\\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine."}]},{"artifact":{"id":"57469482e26b9740","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-10","epss":0.05971,"percentile":0.93125}],"risk":2.9855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723"},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-10","epss":0.05971,"percentile":0.93125}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"71183f78a986047d","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-10","epss":0.05971,"percentile":0.93125}],"risk":2.9855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723"},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-10","epss":0.05971,"percentile":0.93125}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"16a442ba7a1a09d3","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u6?arch=all&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-12723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-12723","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-10","epss":0.05971,"percentile":0.93125}],"risk":2.9855,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-12723"},"relatedVulnerabilities":[{"id":"CVE-2020-12723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-12723","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-12723","date":"2026-10-10","epss":0.05971,"percentile":0.93125}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/Perl/perl5/issues/16947","https://github.com/Perl/perl5/issues/17743","https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","description":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls."}]},{"artifact":{"id":"a905919790c883b9","cpes":["cpe:2.3:a:libsndfile1:libsndfile1:1.0.25-9.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsndfile1","purl":"pkg:deb/debian/libsndfile1@1.0.25-9.1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=libsndfile","type":"deb","version":"1.0.25-9.1+deb8u1","language":"","licenses":["sha256:19e86818263c3a1014c6374e2c85157934a6e9f68ab202c29d202e45574316fb"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsndfile1/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libsndfile1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libsndfile1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libsndfile"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12562","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libsndfile","version":"1.0.25-9.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12562","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-12562","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12562","date":"2026-10-10","epss":0.03978,"percentile":0.90241}],"risk":2.9835000000000003,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12562"},"relatedVulnerabilities":[{"id":"CVE-2017-12562","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12562","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12562","date":"2026-10-10","epss":0.03978,"percentile":0.90241}],"urls":["https://github.com/erikd/libsndfile/issues/292","https://lists.debian.org/debian-lts-announce/2022/06/msg00020.html","https://security.gentoo.org/glsa/201811-23"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12562","description":"Heap-based Buffer Overflow in the psf_binheader_writef function in common.c in libsndfile through 1.0.28 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact."}]},{"artifact":{"id":"313fa3578fbafcd9","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u2:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"2.9.1+dfsg1-5+deb8u2","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-16932","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-16932","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-16932","date":"2026-10-10","epss":0.05928,"percentile":0.93083}],"risk":2.964,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-16932"},"relatedVulnerabilities":[{"id":"CVE-2017-16932","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-16932","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-16932","date":"2026-10-10","epss":0.05928,"percentile":0.93083}],"urls":["http://xmlsoft.org/news.html","https://blog.clamav.net/2018/07/clamav-01001-has-been-released.html","https://bugzilla.gnome.org/show_bug.cgi?id=759579","https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961","https://gitlab.gnome.org/GNOME/libxml2/-/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2017/11/msg00041.html","https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html","https://usn.ubuntu.com/3739-1/","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16932","description":"parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities."}]},{"artifact":{"id":"d91ce551dcf6c33f","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-18+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3706","versionConstraint":"< 2.19-18+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3706","fix":{"state":"fixed","versions":["2.19-18+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.19-18+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3706","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3706","date":"2026-10-10","epss":0.05926,"percentile":0.93079}],"risk":2.963,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3706"},"relatedVulnerabilities":[{"id":"CVE-2016-3706","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3706","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3706","date":"2026-10-10","epss":0.05926,"percentile":0.93079}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.securityfocus.com/bid/102073","http://www.securityfocus.com/bid/88440","https://source.android.com/security/bulletin/2017-12-01","https://sourceware.org/bugzilla/show_bug.cgi?id=20010","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=4ab2ab03d4351914ee53248dc5aef4a8c88ff8b9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3706","description":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458."}]},{"artifact":{"id":"495e1452a66e5099","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-18+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3706","versionConstraint":"< 2.19-18+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3706","fix":{"state":"fixed","versions":["2.19-18+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.19-18+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3706","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3706","date":"2026-10-10","epss":0.05926,"percentile":0.93079}],"risk":2.963,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3706"},"relatedVulnerabilities":[{"id":"CVE-2016-3706","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3706","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3706","date":"2026-10-10","epss":0.05926,"percentile":0.93079}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.securityfocus.com/bid/102073","http://www.securityfocus.com/bid/88440","https://source.android.com/security/bulletin/2017-12-01","https://sourceware.org/bugzilla/show_bug.cgi?id=20010","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=4ab2ab03d4351914ee53248dc5aef4a8c88ff8b9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3706","description":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458."}]},{"artifact":{"id":"6dec8d97d34362ed","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-18+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3706","versionConstraint":"< 2.19-18+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-3706","fix":{"state":"fixed","versions":["2.19-18+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.19-18+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3706","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3706","date":"2026-10-10","epss":0.05926,"percentile":0.93079}],"risk":2.963,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-3706"},"relatedVulnerabilities":[{"id":"CVE-2016-3706","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3706","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3706","date":"2026-10-10","epss":0.05926,"percentile":0.93079}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.securityfocus.com/bid/102073","http://www.securityfocus.com/bid/88440","https://source.android.com/security/bulletin/2017-12-01","https://sourceware.org/bugzilla/show_bug.cgi?id=20010","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=4ab2ab03d4351914ee53248dc5aef4a8c88ff8b9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3706","description":"Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458."}]},{"artifact":{"id":"db8ea562e46a3772","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.7.1-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/debian/libsqlite3-0@3.8.7.1-1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=sqlite3","type":"deb","version":"3.8.7.1-1+deb8u1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.8.7.1-1+deb8u4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-2519","versionConstraint":"< 3.8.7.1-1+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"sqlite3","version":"3.8.7.1-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-2519","fix":{"state":"fixed","versions":["3.8.7.1-1+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"3.8.7.1-1+deb8u4"}]},"cvss":[],"epss":[{"cve":"CVE-2017-2519","date":"2026-10-10","epss":0.0395,"percentile":0.90163}],"risk":2.9625,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-2519"},"relatedVulnerabilities":[{"id":"CVE-2017-2519","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-2519","date":"2026-10-10","epss":0.0395,"percentile":0.90163}],"urls":["http://www.securityfocus.com/bid/98468","http://www.securitytracker.com/id/1038484","https://lists.debian.org/debian-lts-announce/2019/01/msg00009.html","https://support.apple.com/HT207797","https://support.apple.com/HT207798","https://support.apple.com/HT207800","https://support.apple.com/HT207801","https://usn.ubuntu.com/4019-1/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-2519","description":"An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the \"SQLite\" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SQL statement."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u11"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000301","versionConstraint":"< 7.38.0-4+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000301","fix":{"state":"fixed","versions":["7.38.0-4+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-10","epss":0.0592,"percentile":0.93073}],"risk":2.96,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4202-1","link":"https://security-tracker.debian.org/tracker/DSA-4202-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000301"},"relatedVulnerabilities":[{"id":"CVE-2018-1000301","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-10","epss":0.0592,"percentile":0.93073}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104225","http://www.securitytracker.com/id/1040931","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b138.html","https://lists.debian.org/debian-lts-announce/2018/05/msg00010.html","https://security.gentoo.org/glsa/201806-05","https://usn.ubuntu.com/3598-2/","https://usn.ubuntu.com/3648-1/","https://www.debian.org/security/2018/dsa-4202","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000301","description":"curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000301","versionConstraint":"< 7.38.0-4+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000301","fix":{"state":"fixed","versions":["7.38.0-4+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-10","epss":0.0592,"percentile":0.93073}],"risk":2.96,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4202-1","link":"https://security-tracker.debian.org/tracker/DSA-4202-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000301"},"relatedVulnerabilities":[{"id":"CVE-2018-1000301","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-10","epss":0.0592,"percentile":0.93073}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104225","http://www.securitytracker.com/id/1040931","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b138.html","https://lists.debian.org/debian-lts-announce/2018/05/msg00010.html","https://security.gentoo.org/glsa/201806-05","https://usn.ubuntu.com/3598-2/","https://usn.ubuntu.com/3648-1/","https://www.debian.org/security/2018/dsa-4202","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000301","description":"curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000301","versionConstraint":"< 7.38.0-4+deb8u11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-1000301","fix":{"state":"fixed","versions":["7.38.0-4+deb8u11"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-10","epss":0.0592,"percentile":0.93073}],"risk":2.96,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4202-1","link":"https://security-tracker.debian.org/tracker/DSA-4202-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-1000301"},"relatedVulnerabilities":[{"id":"CVE-2018-1000301","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-10","epss":0.0592,"percentile":0.93073}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104225","http://www.securitytracker.com/id/1040931","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b138.html","https://lists.debian.org/debian-lts-announce/2018/05/msg00010.html","https://security.gentoo.org/glsa/201806-05","https://usn.ubuntu.com/3598-2/","https://usn.ubuntu.com/3648-1/","https://www.debian.org/security/2018/dsa-4202","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000301","description":"curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0."}]},{"artifact":{"id":"57469482e26b9740","cpes":["cpe:2.3:a:perl:perl:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/debian/perl@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12883","versionConstraint":"< 5.20.2-3+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12883","fix":{"state":"fixed","versions":["5.20.2-3+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-10","epss":0.05908,"percentile":0.93059}],"risk":2.954,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3982-1","link":"https://security-tracker.debian.org/tracker/DSA-3982-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12883"},"relatedVulnerabilities":[{"id":"CVE-2017-12883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-10","epss":0.05908,"percentile":0.93059}],"urls":["http://mirror.cucumberlinux.com/cucumber/cucumber-1.0/source/lang-base/perl/patches/CVE-2017-12883.patch","http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100852","https://bugzilla.redhat.com/show_bug.cgi?id=1492093","https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f#patch1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131598","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12883","description":"Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape."}]},{"artifact":{"id":"71183f78a986047d","cpes":["cpe:2.3:a:perl-base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/debian/perl-base@5.20.2-3%2Bdeb8u6?arch=amd64&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12883","versionConstraint":"< 5.20.2-3+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12883","fix":{"state":"fixed","versions":["5.20.2-3+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-10","epss":0.05908,"percentile":0.93059}],"risk":2.954,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3982-1","link":"https://security-tracker.debian.org/tracker/DSA-3982-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12883"},"relatedVulnerabilities":[{"id":"CVE-2017-12883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-10","epss":0.05908,"percentile":0.93059}],"urls":["http://mirror.cucumberlinux.com/cucumber/cucumber-1.0/source/lang-base/perl/patches/CVE-2017-12883.patch","http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100852","https://bugzilla.redhat.com/show_bug.cgi?id=1492093","https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f#patch1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131598","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12883","description":"Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape."}]},{"artifact":{"id":"16a442ba7a1a09d3","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.20.2-3\\+deb8u6:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/debian/perl-modules@5.20.2-3%2Bdeb8u6?arch=all&distro=debian-8.5&upstream=perl","type":"deb","version":"5.20.2-3+deb8u6","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.20.2-3+deb8u9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12883","versionConstraint":"< 5.20.2-3+deb8u9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"perl","version":"5.20.2-3+deb8u6"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-12883","fix":{"state":"fixed","versions":["5.20.2-3+deb8u9"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"5.20.2-3+deb8u9"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-10","epss":0.05908,"percentile":0.93059}],"risk":2.954,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3982-1","link":"https://security-tracker.debian.org/tracker/DSA-3982-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-12883"},"relatedVulnerabilities":[{"id":"CVE-2017-12883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-10","epss":0.05908,"percentile":0.93059}],"urls":["http://mirror.cucumberlinux.com/cucumber/cucumber-1.0/source/lang-base/perl/patches/CVE-2017-12883.patch","http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100852","https://bugzilla.redhat.com/show_bug.cgi?id=1492093","https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f#patch1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131598","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12883","description":"Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape."}]},{"artifact":{"id":"7a5def2d8ae90f36","cpes":["cpe:2.3:a:libidn11:libidn11:1.29-1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libidn11","purl":"pkg:deb/debian/libidn11@1.29-1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=libidn","type":"deb","version":"1.29-1+deb8u1","language":"","licenses":["GAP","GFDL-1.3","GFDL-1.3+","GPL-2","GPL-3","GPL-3+","LGPL-2","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libidn11/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libidn11/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libidn11:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libidn11:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libidn"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.29-1+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-14062","versionConstraint":"< 1.29-1+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libidn","version":"1.29-1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-14062","fix":{"state":"fixed","versions":["1.29-1+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.29-1+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-14062","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14062","date":"2026-10-10","epss":0.0389,"percentile":0.89994}],"risk":2.9175,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-14062"},"relatedVulnerabilities":[{"id":"CVE-2017-14062","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-14062","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-14062","date":"2026-10-10","epss":0.0389,"percentile":0.89994}],"urls":["http://www.debian.org/security/2017/dsa-3988","https://gitlab.com/libidn/libidn2/blob/master/NEWS","https://gitlab.com/libidn/libidn2/commit/3284eb342cd0ed1a18786e3fcdf0cdd7e76676bd","https://lists.debian.org/debian-lts-announce/2018/07/msg00040.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-14062","description":"Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u131-2.6.9-2~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3526","versionConstraint":"< 7u131-2.6.9-2~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-3526","fix":{"state":"fixed","versions":["7u131-2.6.9-2~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u131-2.6.9-2~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2017-3526","date":"2026-10-10","epss":0.03836,"percentile":0.8986}],"risk":2.877,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3858-1","link":"https://security-tracker.debian.org/tracker/DSA-3858-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-3526"},"relatedVulnerabilities":[{"id":"CVE-2017-3526","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-3526","date":"2026-10-10","epss":0.03836,"percentile":0.8986}],"urls":["http://www.debian.org/security/2017/dsa-3858","http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html","http://www.securityfocus.com/bid/97733","http://www.securitytracker.com/id/1038286","https://access.redhat.com/errata/RHSA-2017:1108","https://access.redhat.com/errata/RHSA-2017:1109","https://access.redhat.com/errata/RHSA-2017:1117","https://access.redhat.com/errata/RHSA-2017:1118","https://access.redhat.com/errata/RHSA-2017:1119","https://access.redhat.com/errata/RHSA-2017:1204","https://security.gentoo.org/glsa/201705-03","https://security.gentoo.org/glsa/201707-01"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3526","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u171-2.6.13-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2633","versionConstraint":"< 7u171-2.6.13-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-2633","fix":{"state":"fixed","versions":["7u171-2.6.13-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u171-2.6.13-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2633","date":"2026-10-10","epss":0.0565,"percentile":0.92783}],"risk":2.825,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4166-1","link":"https://security-tracker.debian.org/tracker/DSA-4166-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-2633"},"relatedVulnerabilities":[{"id":"CVE-2018-2633","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2633","date":"2026-10-10","epss":0.0565,"percentile":0.92783}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.securityfocus.com/bid/102557","http://www.securitytracker.com/id/1040203","https://access.redhat.com/errata/RHSA-2018:0095","https://access.redhat.com/errata/RHSA-2018:0099","https://access.redhat.com/errata/RHSA-2018:0100","https://access.redhat.com/errata/RHSA-2018:0115","https://access.redhat.com/errata/RHSA-2018:0349","https://access.redhat.com/errata/RHSA-2018:0351","https://access.redhat.com/errata/RHSA-2018:0352","https://access.redhat.com/errata/RHSA-2018:0458","https://access.redhat.com/errata/RHSA-2018:0521","https://access.redhat.com/errata/RHSA-2018:1463","https://access.redhat.com/errata/RHSA-2018:1812","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2018/04/msg00003.html","https://security.netapp.com/advisory/ntap-20180117-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03911en_us","https://usn.ubuntu.com/3613-1/","https://usn.ubuntu.com/3614-1/","https://www.debian.org/security/2018/dsa-4144","https://www.debian.org/security/2018/dsa-4166"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2633","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI). Supported versions that are affected are Java SE: 6u171, 7u161, 8u152 and 9.0.1; Java SE Embedded: 8u151; JRockit: R28.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)."}]},{"artifact":{"id":"84c5f8ed479ca7e3","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.2-3\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.2-3\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.2-3\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.2-3\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.2-3\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.2-3\\+deb8u2:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/debian/libtasn1-6@4.2-3%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"4.2-3+deb8u2","language":"","licenses":["sha256:7faa7a2e10c1267fe75183ec4f0d556d78d9630f29e1a7e704d1f6d67041216f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2-3+deb8u3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-6891","versionConstraint":"< 4.2-3+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libtasn1-6","version":"4.2-3+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-6891","fix":{"state":"fixed","versions":["4.2-3+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"4.2-3+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-6891","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-6891","date":"2026-10-10","epss":0.05585,"percentile":0.92701}],"risk":2.7925,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3861-1","link":"https://security-tracker.debian.org/tracker/DSA-3861-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-6891"},"relatedVulnerabilities":[{"id":"CVE-2017-6891","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-6891","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-6891","date":"2026-10-10","epss":0.05585,"percentile":0.92701}],"urls":["http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=5520704d075802df25ce4ffccc010ba1641bd484","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html","http://www.debian.org/security/2017/dsa-3861","http://www.securityfocus.com/bid/98641","http://www.securitytracker.com/id/1038619","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://secuniaresearch.flexerasoftware.com/advisories/76125/","https://secuniaresearch.flexerasoftware.com/secunia_research/2017-11/","https://security.gentoo.org/glsa/201710-11"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-6891","description":"Two errors in the \"asn1_find_node()\" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility."}]},{"artifact":{"id":"0e06f9c3f3a59b73","cpes":["cpe:2.3:a:liquibase-core:liquibase-core:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:liquibase-core:liquibase_core:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:liquibase_core:liquibase-core:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:liquibase_core:liquibase_core:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:org.liquibase:liquibase-core:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:org.liquibase:liquibase_core:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:liquibase:liquibase-core:2.0.5:*:*:*:*:*:*:*","cpe:2.3:a:liquibase:liquibase_core:2.0.5:*:*:*:*:*:*:*"],"name":"liquibase-core","purl":"pkg:maven/org.liquibase/liquibase-core@2.0.5","type":"java-archive","version":"2.0.5","language":"java","licenses":[],"metadata":{"pomGroupID":"org.liquibase","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/liquibase-core-2.0.5.jar","manifestName":"","pomArtifactID":"liquibase-core","archiveDigests":[{"value":"8cd577e200d45d9f6031ad0e7add6a2d819f2de0","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/liquibase-core-2.0.5.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/liquibase-core-2.0.5.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"4.8.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-jvfv-hrrc-6q72","versionConstraint":"<4.8.0 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.liquibase:liquibase-core","version":"2.0.5"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-jvfv-hrrc-6q72","fix":{"state":"fixed","versions":["4.8.0"],"available":[{"date":"2022-03-09","kind":"first-observed","version":"4.8.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0839","cwe":"CWE-611","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0839","cwe":"CWE-611","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0839","date":"2026-10-10","epss":0.02967,"percentile":0.86854}],"risk":2.78898,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-0839","https://github.com/liquibase/liquibase/commit/33d9d925082097fb1a3d2fc8e44423d964cd9381","https://huntr.dev/bounties/f1ae5779-b406-4594-a8a3-d089c68d6e70","https://www.oracle.com/security-alerts/cpujul2022.html","http://seclists.org/fulldisclosure/2025/Apr/14"],"severity":"Critical","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-jvfv-hrrc-6q72","description":"Improper Restriction of XML External Entity Reference in Liquibase"},"relatedVulnerabilities":[{"id":"CVE-2022-0839","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0839","cwe":"CWE-611","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0839","cwe":"CWE-611","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0839","date":"2026-10-10","epss":0.02967,"percentile":0.86854}],"urls":["https://github.com/liquibase/liquibase/commit/33d9d925082097fb1a3d2fc8e44423d964cd9381","https://huntr.dev/bounties/f1ae5779-b406-4594-a8a3-d089c68d6e70","https://www.oracle.com/security-alerts/cpujul2022.html","http://seclists.org/fulldisclosure/2025/Apr/14"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0839","description":"Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0."}]},{"artifact":{"id":"313fa3578fbafcd9","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-5\\+deb8u2:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/debian/libxml2@2.9.1%2Bdfsg1-5%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"2.9.1+dfsg1-5+deb8u2","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-5+deb8u8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-19956","versionConstraint":"< 2.9.1+dfsg1-5+deb8u8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-5+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-19956","fix":{"state":"fixed","versions":["2.9.1+dfsg1-5+deb8u8"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.9.1+dfsg1-5+deb8u8"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-19956","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19956","cwe":"CWE-772","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-19956","date":"2026-10-10","epss":0.0556,"percentile":0.92667}],"risk":2.78,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-19956"},"relatedVulnerabilities":[{"id":"CVE-2019-19956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19956","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19956","cwe":"CWE-772","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-19956","date":"2026-10-10","epss":0.0556,"percentile":0.92667}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00005.html","https://cert-portal.siemens.com/productcert/pdf/ssa-292794.pdf","https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549","https://lists.debian.org/debian-lts-announce/2019/12/msg00032.html","https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5R55ZR52RMBX24TQTWHCIWKJVRV6YAWI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDPF3AAVKUAKDYFMFKSIQSVVS3EEFPQH/","https://security.netapp.com/advisory/ntap-20200114-0002/","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-08","https://usn.ubuntu.com/4274-1/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19956","description":"xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 before 2.9.10 has a memory leak related to newDoc->oldNs."}]},{"artifact":{"id":"3d9e6c79cce3e33f","cpes":["cpe:2.3:a:com.google.guava:guava:11.0.2-atlassian-02:*:*:*:*:*:*:*","cpe:2.3:a:google:guava:11.0.2-atlassian-02:*:*:*:*:*:*:*","cpe:2.3:a:guava:guava:11.0.2-atlassian-02:*:*:*:*:*:*:*"],"name":"guava","purl":"pkg:maven/com.google.guava/guava@11.0.2-atlassian-02","type":"java-archive","version":"11.0.2-atlassian-02","language":"java","licenses":[],"metadata":{"pomGroupID":"com.google.guava","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/guava-11.0.2-atlassian-02.jar","manifestName":"","pomArtifactID":"guava","archiveDigests":[{"value":"f05e3bfdeabdb6960564342885f09cd105025239","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/guava-11.0.2-atlassian-02.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/guava-11.0.2-atlassian-02.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"24.1.1-android"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-mvr2-9pj6-7w5j","versionConstraint":">=11.0,<24.1.1-android (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.google.guava:guava","version":"11.0.2-atlassian-02"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-mvr2-9pj6-7w5j","fix":{"state":"fixed","versions":["24.1.1-android"],"available":[{"date":"2023-11-10","kind":"first-observed","version":"24.1.1-android"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10237","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10237","date":"2026-10-10","epss":0.05086,"percentile":0.92147}],"risk":2.7718700000000003,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-10237","https://github.com/google/guava/wiki/CVE-2018-10237","https://groups.google.com/d/topic/guava-announce/xqWALw4W1vs/discussion","http://www.securitytracker.com/id/1041707","https://access.redhat.com/errata/RHSA-2018:2423","https://access.redhat.com/errata/RHSA-2018:2424","https://access.redhat.com/errata/RHSA-2018:2425","https://access.redhat.com/errata/RHSA-2018:2428","https://access.redhat.com/errata/RHSA-2018:2598","https://access.redhat.com/errata/RHSA-2018:2643","https://access.redhat.com/errata/RHSA-2018:2740","https://access.redhat.com/errata/RHSA-2018:2741","https://access.redhat.com/errata/RHSA-2018:2742","https://access.redhat.com/errata/RHSA-2018:2743","https://access.redhat.com/errata/RHSA-2018:2927","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/19fa48533bc7ea1accf6b12746a74ed888ae6e49a5cf81ae4f807495@%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/33c6bccfeb7adf644d4d79894ca8f09370be6ed4b20632c2e228d085@%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/3d5dbdd92ac9ceaef90e40f78599f9109f2f345252e0ac9d98e7e084@%3Cgitbox.activemq.apache.org%3E","https://lists.apache.org/thread.html/3ddd79c801edd99c0978e83dbe2168ebd36fd42acfa5dac38fb03dd6@%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/cc48fe770c45a74dc3b37ed0817393e0c96701fc49bc431ed922f3cc@%3Chdfs-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r27eb79a87a760335226dbfa6a7b7bffea539a535f8e80c41e482106d@%3Cdev.cxf.apache.org%3E","https://lists.apache.org/thread.html/r2ea4e5e5aa8ad73b001a466c582899620961f47d77a40af712c1fdf9@%3Cdev.cxf.apache.org%3E","https://lists.apache.org/thread.html/r38e2ab87528d3c904e7fac496e8fd766b9277656ff95b97d6b6b6dcd@%3Cdev.cxf.apache.org%3E","https://lists.apache.org/thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540@%3Cdev.syncope.apache.org%3E","https://lists.apache.org/thread.html/r95799427b335807a4c54776908125c3e66597b65845ae50096d9278a@%3Cdev.cxf.apache.org%3E","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b@%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rc78f6e84f82cc662860e96526d8ab969f34dbe12dc560e22d9d147a3@%3Cdev.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc8467f357b943ceaa86f289f8bc1a5d1c7955b75d3bac1426f2d4ac1@%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rd0c8ec6e044aa2958dd0549ebf8ecead7f5968c9474ba73a504161b2@%3Cdev.cxf.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb@%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb@%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/r223bc776a077d0795786c38cbc6e7dd808fce1a9161b00ba9c0a5d55@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r50fc0bcc734dd82e691d36d209258683141bfc0083739a77e56ad92d@%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/ra4f44016926dcb034b3b230280a18102062f94ae55b8a31bb92fed84@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/ra8906723927aef2a599398c238eacfc845b74d812e0093ec2fc70a7d@%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/rb3da574c34bc6bd37972d2266af3093b90d7e437460423c24f477919@%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rdc56c15693c236e31e1e95f847b8e5e74fc0a05741d47488e7fc8c45@%3Cissues.flink.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2021.html","https://lists.apache.org/thread.html/r841c5e14e1b55281523ebcde661ece00b38a0569e00ef5e12bd5f6ba@%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r22c8173b804cd4a420c43064ba4e363d0022aa421008b1989f7354d4@%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/r30e7d7b6bfa630dacc41649a0e96dad75165d50474c1241068aa0f94@%3Cissues.storm.apache.org%3E","https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21@%3Ccommits.samza.apache.org%3E","https://lists.apache.org/thread.html/r3c3b33ee5bef0c67391d27a97cbfd89d44f328cf072b601b58d4e748@%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/rd01f5ff0164c468ec7abc96ff7646cea3cce6378da2e4aa29c6bcb95@%3Cgithub.arrow.apache.org%3E","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.netapp.com/advisory/ntap-20220629-0008/"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-mvr2-9pj6-7w5j","description":"Denial of Service in Google Guava"},"relatedVulnerabilities":[{"id":"CVE-2018-10237","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-10237","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-10237","date":"2026-10-10","epss":0.05086,"percentile":0.92147}],"urls":["http://www.securitytracker.com/id/1041707","https://access.redhat.com/errata/RHSA-2018:2423","https://access.redhat.com/errata/RHSA-2018:2424","https://access.redhat.com/errata/RHSA-2018:2425","https://access.redhat.com/errata/RHSA-2018:2428","https://access.redhat.com/errata/RHSA-2018:2598","https://access.redhat.com/errata/RHSA-2018:2643","https://access.redhat.com/errata/RHSA-2018:2740","https://access.redhat.com/errata/RHSA-2018:2741","https://access.redhat.com/errata/RHSA-2018:2742","https://access.redhat.com/errata/RHSA-2018:2743","https://access.redhat.com/errata/RHSA-2018:2927","https://access.redhat.com/errata/RHSA-2019:2858","https://access.redhat.com/errata/RHSA-2019:3149","https://groups.google.com/d/topic/guava-announce/xqWALw4W1vs/discussion","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/19fa48533bc7ea1accf6b12746a74ed888ae6e49a5cf81ae4f807495%40%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/33c6bccfeb7adf644d4d79894ca8f09370be6ed4b20632c2e228d085%40%3Ccommits.cassandra.apache.org%3E","https://lists.apache.org/thread.html/3d5dbdd92ac9ceaef90e40f78599f9109f2f345252e0ac9d98e7e084%40%3Cgitbox.activemq.apache.org%3E","https://lists.apache.org/thread.html/3ddd79c801edd99c0978e83dbe2168ebd36fd42acfa5dac38fb03dd6%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E","https://lists.apache.org/thread.html/cc48fe770c45a74dc3b37ed0817393e0c96701fc49bc431ed922f3cc%40%3Chdfs-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb%40%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/r02e39d7beb32eebcdbb4b516e95f67d71c90d5d462b26f4078d21eeb%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/r223bc776a077d0795786c38cbc6e7dd808fce1a9161b00ba9c0a5d55%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/r22c8173b804cd4a420c43064ba4e363d0022aa421008b1989f7354d4%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/r27eb79a87a760335226dbfa6a7b7bffea539a535f8e80c41e482106d%40%3Cdev.cxf.apache.org%3E","https://lists.apache.org/thread.html/r2ea4e5e5aa8ad73b001a466c582899620961f47d77a40af712c1fdf9%40%3Cdev.cxf.apache.org%3E","https://lists.apache.org/thread.html/r30e7d7b6bfa630dacc41649a0e96dad75165d50474c1241068aa0f94%40%3Cissues.storm.apache.org%3E","https://lists.apache.org/thread.html/r352e40ca9874d1beb4ad95403792adca7eb295e6bc3bd7b65fabcc21%40%3Ccommits.samza.apache.org%3E","https://lists.apache.org/thread.html/r38e2ab87528d3c904e7fac496e8fd766b9277656ff95b97d6b6b6dcd%40%3Cdev.cxf.apache.org%3E","https://lists.apache.org/thread.html/r3c3b33ee5bef0c67391d27a97cbfd89d44f328cf072b601b58d4e748%40%3Ccommits.pulsar.apache.org%3E","https://lists.apache.org/thread.html/r43491b25b2e5c368c34b106a82eff910a5cea3e90de82ad75cc16540%40%3Cdev.syncope.apache.org%3E","https://lists.apache.org/thread.html/r50fc0bcc734dd82e691d36d209258683141bfc0083739a77e56ad92d%40%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/r841c5e14e1b55281523ebcde661ece00b38a0569e00ef5e12bd5f6ba%40%3Cissues.maven.apache.org%3E","https://lists.apache.org/thread.html/r95799427b335807a4c54776908125c3e66597b65845ae50096d9278a%40%3Cdev.cxf.apache.org%3E","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/ra4f44016926dcb034b3b230280a18102062f94ae55b8a31bb92fed84%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/ra8906723927aef2a599398c238eacfc845b74d812e0093ec2fc70a7d%40%3Cissues.flink.apache.org%3E","https://lists.apache.org/thread.html/rb3da574c34bc6bd37972d2266af3093b90d7e437460423c24f477919%40%3Cissues.lucene.apache.org%3E","https://lists.apache.org/thread.html/rc78f6e84f82cc662860e96526d8ab969f34dbe12dc560e22d9d147a3%40%3Cdev.cxf.apache.org%3E","https://lists.apache.org/thread.html/rc8467f357b943ceaa86f289f8bc1a5d1c7955b75d3bac1426f2d4ac1%40%3Ccommon-dev.hadoop.apache.org%3E","https://lists.apache.org/thread.html/rd01f5ff0164c468ec7abc96ff7646cea3cce6378da2e4aa29c6bcb95%40%3Cgithub.arrow.apache.org%3E","https://lists.apache.org/thread.html/rd0c8ec6e044aa2958dd0549ebf8ecead7f5968c9474ba73a504161b2%40%3Cdev.cxf.apache.org%3E","https://lists.apache.org/thread.html/rdc56c15693c236e31e1e95f847b8e5e74fc0a05741d47488e7fc8c45%40%3Cissues.flink.apache.org%3E","https://security.netapp.com/advisory/ntap-20220629-0008/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-10237","description":"Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable."}]},{"artifact":{"id":"fba939281274a473","cpes":["cpe:2.3:a:logback-core:logback-core:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback-core:logback_core:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback-core:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback_core:logback_core:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback-core:1.0.13:*:*:*:*:*:*:*","cpe:2.3:a:logback:logback_core:1.0.13:*:*:*:*:*:*:*"],"name":"logback-core","purl":"pkg:maven/ch.qos.logback/logback-core@1.0.13","type":"java-archive","version":"1.0.13","language":"java","licenses":["http://www.eclipse.org/legal/epl-v10.html, http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"ch.qos.logback","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/logback-core-1.0.13.jar","manifestName":"","pomArtifactID":"logback-core","archiveDigests":[{"value":"dc6e6ce937347bd4d990fc89f4ceb469db53e45e","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/logback-core-1.0.13.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/logback-core-1.0.13.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.2.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-668q-qrv7-99fm","versionConstraint":"<1.2.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"ch.qos.logback:logback-core","version":"1.0.13"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-668q-qrv7-99fm","fix":{"state":"fixed","versions":["1.2.9"],"available":[{"date":"2022-03-29","kind":"first-observed","version":"1.2.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42550","cwe":"CWE-502","type":"Secondary","source":"vulnerability@ncsc.ch"},{"cve":"CVE-2021-42550","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42550","date":"2026-10-10","epss":0.0477,"percentile":0.91697}],"risk":2.7665999999999995,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-42550","https://github.com/cn-panda/logbackRceDemo","https://jira.qos.ch/browse/LOGBACK-1591","http://logback.qos.ch/news.html","https://github.com/qos-ch/logback/commit/87291079a1de9369ac67e20dc70a8fdc7cc4359c","https://github.com/qos-ch/logback/commit/ef4fc4186b74b45ce80d86833820106ff27edd42","https://github.com/qos-ch/logback/blob/1502cba4c1dfd135b2e715bc0cf80c0045d4d128/logback-site/src/site/pages/news.html","https://security.netapp.com/advisory/ntap-20211229-0001/","http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","http://seclists.org/fulldisclosure/2022/Jul/11","https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-668q-qrv7-99fm","description":"Deserialization of Untrusted Data in logback"},"relatedVulnerabilities":[{"id":"CVE-2021-42550","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","metrics":{"baseScore":8.5,"impactScore":10.1,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"vulnerability@ncsc.ch","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-42550","cwe":"CWE-502","type":"Secondary","source":"vulnerability@ncsc.ch"},{"cve":"CVE-2021-42550","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-42550","date":"2026-10-10","epss":0.0477,"percentile":0.91697}],"urls":["http://logback.qos.ch/news.html","http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html","http://seclists.org/fulldisclosure/2022/Jul/11","https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf","https://github.com/cn-panda/logbackRceDemo","https://jira.qos.ch/browse/LOGBACK-1591","https://security.netapp.com/advisory/ntap-20211229-0001/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-42550","description":"In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers."}]},{"artifact":{"id":"873b102f52bbb132","cpes":["cpe:2.3:a:apache:commons-compress:1.8.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.8.1:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.8.1:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.8.1","type":"java-archive","version":"1.8.1","language":"java","licenses":[],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:org.apache.commons:commons-compress","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hrmr-f5m6-m9pq","versionConstraint":">=1.7,<1.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.8.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hrmr-f5m6-m9pq","fix":{"state":"fixed","versions":["1.18"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11771","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11771","date":"2026-10-10","epss":0.05253,"percentile":0.92347}],"risk":2.7578250000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-11771","https://lists.apache.org/thread.html/0adb631517766e793e18a59723e2df08ced41eb9a57478f14781c9f7@%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/3565494c263dfeb4dcb2a71cb24d09a1ca285cd6ac74edc025a3af8a@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/35f60d6d0407c13c39411038ba1aca71d92595ed7041beff4d07f2ee@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/6c79965066c30d4e330e04d911d3761db41b82c89ae38d9a6b37a6f1@%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/714c6ac1b1b50f8557e7342903ef45f1538a7bc60a0b47d6e48c273d@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/b8da751fc0ca949534cdf2744111da6bb0349d2798fac94b0a50f330@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/b8ef29df0f1d55aa741170748352ae8e425c7b1d286b2f257711a2dd@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/b907e70bc422905d7962fd18f863f746bf7b4e7ed9da25c148580c61@%3Cnotifications.commons.apache.org%3E","https://lists.apache.org/thread.html/c7954dc1e8fafd7ca1449f078953b419ebf8936e087f235f3bd024be@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/e3eae9e6fc021c4c22dda59a335d21c12eecab480b48115a2f098ef6@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/eeecc1669242b28a3777ae13c68b376b0148d589d3d8170340d61120@%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/f28052d04cb8dbaae39bfd3dc8438e58c2a8be306a3f381f4728d7c1@%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/f9cdd32af7d73e943452167d15801db39e8130409ebb9efb243b3f41@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E","http://www.securityfocus.com/bid/105139","http://www.securitytracker.com/id/1041503","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hrmr-f5m6-m9pq","description":"Moderate severity vulnerability that affects org.apache.commons:commons-compress"},"relatedVulnerabilities":[{"id":"CVE-2018-11771","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11771","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11771","date":"2026-10-10","epss":0.05253,"percentile":0.92347}],"urls":["http://www.securityfocus.com/bid/105139","http://www.securitytracker.com/id/1041503","https://lists.apache.org/thread.html/0adb631517766e793e18a59723e2df08ced41eb9a57478f14781c9f7%40%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/3565494c263dfeb4dcb2a71cb24d09a1ca285cd6ac74edc025a3af8a%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/35f60d6d0407c13c39411038ba1aca71d92595ed7041beff4d07f2ee%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/6c79965066c30d4e330e04d911d3761db41b82c89ae38d9a6b37a6f1%40%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/714c6ac1b1b50f8557e7342903ef45f1538a7bc60a0b47d6e48c273d%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/b8da751fc0ca949534cdf2744111da6bb0349d2798fac94b0a50f330%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/b8ef29df0f1d55aa741170748352ae8e425c7b1d286b2f257711a2dd%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/b907e70bc422905d7962fd18f863f746bf7b4e7ed9da25c148580c61%40%3Cnotifications.commons.apache.org%3E","https://lists.apache.org/thread.html/c7954dc1e8fafd7ca1449f078953b419ebf8936e087f235f3bd024be%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/e3eae9e6fc021c4c22dda59a335d21c12eecab480b48115a2f098ef6%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/eeecc1669242b28a3777ae13c68b376b0148d589d3d8170340d61120%40%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/f28052d04cb8dbaae39bfd3dc8438e58c2a8be306a3f381f4728d7c1%40%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/f9cdd32af7d73e943452167d15801db39e8130409ebb9efb243b3f41%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11771","description":"When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package."}]},{"artifact":{"id":"8869864fb9ead82c","cpes":["cpe:2.3:a:apache:commons-compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons_compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:compress:1.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:commons:1.9:*:*:*:*:*:*:*"],"name":"commons-compress","purl":"pkg:maven/org.apache.commons/commons-compress@1.9","type":"java-archive","version":"1.9","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt"],"metadata":{"pomGroupID":"org.apache.commons","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","manifestName":"","pomArtifactID":"commons-compress","archiveDigests":[{"value":"cc18955ff1e36d5abd39a14bfe82b19154330a34","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/commons-compress-1.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.18"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hrmr-f5m6-m9pq","versionConstraint":">=1.7,<1.18 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.commons:commons-compress","version":"1.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-hrmr-f5m6-m9pq","fix":{"state":"fixed","versions":["1.18"],"available":[{"date":"2020-07-28","kind":"first-observed","version":"1.18"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11771","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11771","date":"2026-10-10","epss":0.05253,"percentile":0.92347}],"risk":2.7578250000000004,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-11771","https://lists.apache.org/thread.html/0adb631517766e793e18a59723e2df08ced41eb9a57478f14781c9f7@%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/3565494c263dfeb4dcb2a71cb24d09a1ca285cd6ac74edc025a3af8a@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/35f60d6d0407c13c39411038ba1aca71d92595ed7041beff4d07f2ee@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/6c79965066c30d4e330e04d911d3761db41b82c89ae38d9a6b37a6f1@%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/714c6ac1b1b50f8557e7342903ef45f1538a7bc60a0b47d6e48c273d@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/b8da751fc0ca949534cdf2744111da6bb0349d2798fac94b0a50f330@%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/b8ef29df0f1d55aa741170748352ae8e425c7b1d286b2f257711a2dd@%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/b907e70bc422905d7962fd18f863f746bf7b4e7ed9da25c148580c61@%3Cnotifications.commons.apache.org%3E","https://lists.apache.org/thread.html/c7954dc1e8fafd7ca1449f078953b419ebf8936e087f235f3bd024be@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/e3eae9e6fc021c4c22dda59a335d21c12eecab480b48115a2f098ef6@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/eeecc1669242b28a3777ae13c68b376b0148d589d3d8170340d61120@%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/f28052d04cb8dbaae39bfd3dc8438e58c2a8be306a3f381f4728d7c1@%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/f9cdd32af7d73e943452167d15801db39e8130409ebb9efb243b3f41@%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E","http://www.securityfocus.com/bid/105139","http://www.securitytracker.com/id/1041503","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hrmr-f5m6-m9pq","description":"Moderate severity vulnerability that affects org.apache.commons:commons-compress"},"relatedVulnerabilities":[{"id":"CVE-2018-11771","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11771","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11771","date":"2026-10-10","epss":0.05253,"percentile":0.92347}],"urls":["http://www.securityfocus.com/bid/105139","http://www.securitytracker.com/id/1041503","https://lists.apache.org/thread.html/0adb631517766e793e18a59723e2df08ced41eb9a57478f14781c9f7%40%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/3565494c263dfeb4dcb2a71cb24d09a1ca285cd6ac74edc025a3af8a%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/35f60d6d0407c13c39411038ba1aca71d92595ed7041beff4d07f2ee%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/6c79965066c30d4e330e04d911d3761db41b82c89ae38d9a6b37a6f1%40%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/714c6ac1b1b50f8557e7342903ef45f1538a7bc60a0b47d6e48c273d%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/b8da751fc0ca949534cdf2744111da6bb0349d2798fac94b0a50f330%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/b8ef29df0f1d55aa741170748352ae8e425c7b1d286b2f257711a2dd%40%3Cdev.creadur.apache.org%3E","https://lists.apache.org/thread.html/b907e70bc422905d7962fd18f863f746bf7b4e7ed9da25c148580c61%40%3Cnotifications.commons.apache.org%3E","https://lists.apache.org/thread.html/c7954dc1e8fafd7ca1449f078953b419ebf8936e087f235f3bd024be%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/e3eae9e6fc021c4c22dda59a335d21c12eecab480b48115a2f098ef6%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/eeecc1669242b28a3777ae13c68b376b0148d589d3d8170340d61120%40%3Cdev.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/f28052d04cb8dbaae39bfd3dc8438e58c2a8be306a3f381f4728d7c1%40%3Ccommits.commons.apache.org%3E","https://lists.apache.org/thread.html/f9cdd32af7d73e943452167d15801db39e8130409ebb9efb243b3f41%40%3Ccommits.tinkerpop.apache.org%3E","https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11771","description":"When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package."}]},{"artifact":{"id":"30398275d6b98583","cpes":["cpe:2.3:a:libfreetype6:libfreetype6:2.5.2-3\\+deb8u1:*:*:*:*:*:*:*"],"name":"libfreetype6","purl":"pkg:deb/debian/libfreetype6@2.5.2-3%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=freetype","type":"deb","version":"2.5.2-3+deb8u1","language":"","licenses":["BSD-2-Clause","BSD-3-Clause","Catharon-OSL","FTL","GPL-2","GPL-2+","GZip","OpenGroup-BSD-like"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libfreetype6/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libfreetype6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libfreetype6:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libfreetype6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"freetype"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.5.2-3+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8287","versionConstraint":"< 2.5.2-3+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"freetype","version":"2.5.2-3+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-8287","fix":{"state":"fixed","versions":["2.5.2-3+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.5.2-3+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8287","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8287","date":"2026-10-10","epss":0.03614,"percentile":0.89213}],"risk":2.7104999999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3839-1","link":"https://security-tracker.debian.org/tracker/DSA-3839-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-8287"},"relatedVulnerabilities":[{"id":"CVE-2017-8287","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8287","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-8287","date":"2026-10-10","epss":0.03614,"percentile":0.89213}],"urls":["http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3774fc08b502c3e685afca098b6e8a195aded6a0","http://www.debian.org/security/2017/dsa-3839","http://www.securityfocus.com/bid/99091","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=941","https://security.gentoo.org/glsa/201706-14","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8287","description":"FreeType 2 before 2017-03-26 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c."}]},{"artifact":{"id":"b2e9d0d262bd404c","cpes":["cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.1.1:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.1.1:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.1.1","type":"java-archive","version":"2.1.1","language":"java","licenses":[],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar:com.fasterxml.jackson.core:jackson-databind","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":null},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:analytics-client-3.70.1.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rpr3-cw39-3pxh","versionConstraint":"<=2.9.10.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.1.1"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rpr3-cw39-3pxh","fix":{"state":"fixed","versions":["2.9.10.4"],"available":[{"date":"2022-07-16","kind":"first-observed","version":"2.9.10.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10650","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10650","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10650","date":"2026-10-10","epss":0.03471,"percentile":0.88774}],"risk":2.7073799999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-10650","https://github.com/FasterXML/jackson-databind/issues/2658","https://github.com/luisgarciacheckmarx/LGV_onefile/issues/19","https://github.com/FasterXML/jackson-databind/pull/2864","https://github.com/FasterXML/jackson-databind/commit/a424c038ba0c0d65e579e22001dec925902ac0ef","https://www.oracle.com/security-alerts/cpujan2021.html","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://www.oracle.com/security-alerts/cpuoct2022.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00032.html","https://security.netapp.com/advisory/ntap-20230818-0007"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rpr3-cw39-3pxh","description":"jackson-databind vulnerable to unsafe deserialization"},"relatedVulnerabilities":[{"id":"CVE-2020-10650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10650","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10650","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10650","date":"2026-10-10","epss":0.03471,"percentile":0.88774}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a424c038ba0c0d65e579e22001dec925902ac0ef","https://github.com/FasterXML/jackson-databind/issues/2658","https://github.com/advisories/GHSA-rpr3-cw39-3pxh","https://lists.debian.org/debian-lts-announce/2023/04/msg00032.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20230818-0007/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10650","description":"A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider."}]},{"artifact":{"id":"951bd112da2f4b4e","cpes":["cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core.jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml.jackson.core:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson-databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson_databind:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:com.fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson-databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson_databind:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:fasterxml:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:jackson:jackson:2.3.2:*:*:*:*:*:*:*","cpe:2.3:a:core:jackson:2.3.2:*:*:*:*:*:*:*"],"name":"jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.3.2","type":"java-archive","version":"2.3.2","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0.txt, http://www.gnu.org/licenses/lgpl-2.1.html"],"metadata":{"pomGroupID":"com.fasterxml.jackson.core","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","manifestName":"","pomArtifactID":"jackson-databind","archiveDigests":[{"value":"c75edc740a6d8cb1cef6fa82fa594e0bce561916","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:atlassian-remote-event-common-plugin-1.0.4.jar:META-INF/lib/jackson-databind-2.3.2.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.9.10.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-rpr3-cw39-3pxh","versionConstraint":"<=2.9.10.3 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","version":"2.3.2"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-rpr3-cw39-3pxh","fix":{"state":"fixed","versions":["2.9.10.4"],"available":[{"date":"2022-07-16","kind":"first-observed","version":"2.9.10.4"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10650","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10650","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10650","date":"2026-10-10","epss":0.03471,"percentile":0.88774}],"risk":2.7073799999999997,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-10650","https://github.com/FasterXML/jackson-databind/issues/2658","https://github.com/luisgarciacheckmarx/LGV_onefile/issues/19","https://github.com/FasterXML/jackson-databind/pull/2864","https://github.com/FasterXML/jackson-databind/commit/a424c038ba0c0d65e579e22001dec925902ac0ef","https://www.oracle.com/security-alerts/cpujan2021.html","https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://www.oracle.com/security-alerts/cpuoct2022.html","https://lists.debian.org/debian-lts-announce/2023/04/msg00032.html","https://security.netapp.com/advisory/ntap-20230818-0007"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-rpr3-cw39-3pxh","description":"jackson-databind vulnerable to unsafe deserialization"},"relatedVulnerabilities":[{"id":"CVE-2020-10650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10650","cwe":"CWE-502","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10650","cwe":"CWE-502","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-10650","date":"2026-10-10","epss":0.03471,"percentile":0.88774}],"urls":["https://github.com/FasterXML/jackson-databind/commit/a424c038ba0c0d65e579e22001dec925902ac0ef","https://github.com/FasterXML/jackson-databind/issues/2658","https://github.com/advisories/GHSA-rpr3-cw39-3pxh","https://lists.debian.org/debian-lts-announce/2023/04/msg00032.html","https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062","https://security.netapp.com/advisory/ntap-20230818-0007/","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10650","description":"A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to perform code execution via ignite-jta or quartz-core: org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup, org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory, and org.quartz.utils.JNDIConnectionProvider."}]},{"artifact":{"id":"d91ce551dcf6c33f","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-18+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-1234","versionConstraint":"< 2.19-18+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-1234","fix":{"state":"fixed","versions":["2.19-18+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.19-18+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1234","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1234","date":"2026-10-10","epss":0.0539,"percentile":0.92483}],"risk":2.6950000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-1234"},"relatedVulnerabilities":[{"id":"CVE-2016-1234","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1234","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1234","date":"2026-10-10","epss":0.0539,"percentile":0.92483}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html","http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html","http://seclists.org/fulldisclosure/2021/Sep/0","http://www.openwall.com/lists/oss-security/2016/03/07/16","http://www.securityfocus.com/bid/84204","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=19779","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5171f3079f2cc53e0548fc4967361f4d1ce9d7ea"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1234","description":"Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name."}]},{"artifact":{"id":"495e1452a66e5099","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-18+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-1234","versionConstraint":"< 2.19-18+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-1234","fix":{"state":"fixed","versions":["2.19-18+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.19-18+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1234","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1234","date":"2026-10-10","epss":0.0539,"percentile":0.92483}],"risk":2.6950000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-1234"},"relatedVulnerabilities":[{"id":"CVE-2016-1234","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1234","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1234","date":"2026-10-10","epss":0.0539,"percentile":0.92483}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html","http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html","http://seclists.org/fulldisclosure/2021/Sep/0","http://www.openwall.com/lists/oss-security/2016/03/07/16","http://www.securityfocus.com/bid/84204","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=19779","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5171f3079f2cc53e0548fc4967361f4d1ce9d7ea"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1234","description":"Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name."}]},{"artifact":{"id":"6dec8d97d34362ed","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-18+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-1234","versionConstraint":"< 2.19-18+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-1234","fix":{"state":"fixed","versions":["2.19-18+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.19-18+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1234","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1234","date":"2026-10-10","epss":0.0539,"percentile":0.92483}],"risk":2.6950000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-1234"},"relatedVulnerabilities":[{"id":"CVE-2016-1234","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1234","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1234","date":"2026-10-10","epss":0.0539,"percentile":0.92483}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184626.html","http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html","http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html","http://seclists.org/fulldisclosure/2021/Sep/0","http://www.openwall.com/lists/oss-security/2016/03/07/16","http://www.securityfocus.com/bid/84204","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201702-11","https://sourceware.org/bugzilla/show_bug.cgi?id=19779","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5171f3079f2cc53e0548fc4967361f4d1ce9d7ea"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1234","description":"Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attackers to cause a denial of service (crash) via a long name."}]},{"artifact":{"id":"5afa9905364e4cf8","cpes":["cpe:2.3:a:bouncycastle-org:bcprov-jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle-org:bcprov_jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov-jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle_org:bcprov_jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov-jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:org.bouncycastle:bcprov_jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15on:bcprov-jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:bcprov-jdk15on:bcprov_jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15on:bcprov-jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:bcprov_jdk15on:bcprov_jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov-jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:bouncycastle:bcprov_jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov-jdk15on:1.52:*:*:*:*:*:*:*","cpe:2.3:a:bcprov:bcprov_jdk15on:1.52:*:*:*:*:*:*:*"],"name":"bcprov-jdk15on","purl":"pkg:maven/org.bouncycastle/bcprov-jdk15on@1.52","type":"java-archive","version":"1.52","language":"java","licenses":[],"metadata":{"pomGroupID":"org.bouncycastle","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/bcprov-jdk15on-1.52.jar","manifestName":"","pomArtifactID":"bcprov-jdk15on","archiveDigests":[{"value":"88a941faf9819d371e3174b5ed56a3f3f7d73269","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/bcprov-jdk15on-1.52.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/bcprov-jdk15on-1.52.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.60"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xqj7-j8j5-f2xr","versionConstraint":"<1.60 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.bouncycastle:bcprov-jdk15on","version":"1.52"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-xqj7-j8j5-f2xr","fix":{"state":"fixed","versions":["1.60"],"available":[{"date":"2025-09-13","kind":"first-observed","version":"1.60"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000180","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000180","date":"2026-10-10","epss":0.03576,"percentile":0.89104}],"risk":2.682,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-1000180","https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad","https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839","https://access.redhat.com/errata/RHSA-2018:2423","https://access.redhat.com/errata/RHSA-2018:2424","https://access.redhat.com/errata/RHSA-2018:2425","https://access.redhat.com/errata/RHSA-2018:2428","https://access.redhat.com/errata/RHSA-2018:2643","https://access.redhat.com/errata/RHSA-2018:2669","https://access.redhat.com/errata/RHSA-2019:0877","https://github.com/bcgit/bc-java/wiki/CVE-2018-1000180","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E","https://www.bountysource.com/issues/58293083-rsa-key-generation-computation-of-iterations-for-mr-primality-test","https://www.debian.org/security/2018/dsa-4233","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","http://www.securityfocus.com/bid/106567","https://security.netapp.com/advisory/ntap-20190204-0003"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xqj7-j8j5-f2xr","description":"Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator"},"relatedVulnerabilities":[{"id":"CVE-2018-1000180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000180","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000180","date":"2026-10-10","epss":0.03576,"percentile":0.89104}],"urls":["http://www.securityfocus.com/bid/106567","https://access.redhat.com/errata/RHSA-2018:2423","https://access.redhat.com/errata/RHSA-2018:2424","https://access.redhat.com/errata/RHSA-2018:2425","https://access.redhat.com/errata/RHSA-2018:2428","https://access.redhat.com/errata/RHSA-2018:2643","https://access.redhat.com/errata/RHSA-2018:2669","https://access.redhat.com/errata/RHSA-2019:0877","https://github.com/bcgit/bc-java/commit/22467b6e8fe19717ecdf201c0cf91bacf04a55ad","https://github.com/bcgit/bc-java/commit/73780ac522b7795fc165630aba8d5f5729acc839","https://github.com/bcgit/bc-java/wiki/CVE-2018-1000180","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E","https://security.netapp.com/advisory/ntap-20190204-0003/","https://www.bountysource.com/issues/58293083-rsa-key-generation-computation-of-iterations-for-mr-primality-test","https://www.debian.org/security/2018/dsa-4233","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000180","description":"Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later."}]},{"artifact":{"id":"a201411485f90695","cpes":["cpe:2.3:a:org.springframework.security:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:org.springframework.security:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:security:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:security:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security-web:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security_web:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring-security-web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:spring_security_web:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring-security:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring_security:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:springframework:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:security:security:3.2.7.RELEASE:*:*:*:*:*:*:*","cpe:2.3:a:spring:security:3.2.7.RELEASE:*:*:*:*:*:*:*"],"name":"spring-security-web","purl":"pkg:maven/org.springframework.security/spring-security-web@3.2.7.RELEASE","type":"java-archive","version":"3.2.7.RELEASE","language":"java","licenses":[],"metadata":{"pomGroupID":"org.springframework.security","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-security-web-3.2.7.RELEASE.jar","manifestName":"","pomArtifactID":"spring-security-web","archiveDigests":[{"value":"3170f54765d6d9f99cf2d4ba7f25698d1026cf6f","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-security-web-3.2.7.RELEASE.jar","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/lib/spring-security-web-3.2.7.RELEASE.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"5.2.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gq28-h5vg-8prx","versionConstraint":"<5.2.9 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.springframework.security:spring-security-web","version":"3.2.7.RELEASE"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-gq28-h5vg-8prx","fix":{"state":"fixed","versions":["5.2.9"],"available":[{"date":"2021-05-11","kind":"first-observed","version":"5.2.9"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-22112","date":"2026-10-10","epss":0.03286,"percentile":0.88152}],"risk":2.6780900000000005,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-22112","https://github.com/spring-projects/spring-security/releases/tag/5.4.4","https://tanzu.vmware.com/security/cve-2021-22112","https://www.jenkins.io/security/advisory/2021-02-19/","http://www.openwall.com/lists/oss-security/2021/02/19/7","https://lists.apache.org/thread.html/redbd004a503b3520ae5746c2ab5e93fd7da807a8c128e60d2002cd9b@%3Cissues.nifi.apache.org%3E","https://www.oracle.com/security-alerts/cpuApr2021.html","https://lists.apache.org/thread.html/r2cb05e499807900ba23e539643eead9c5f0652fd271f223f89da1804@%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/r37423ec7eea340e92a409452c35b649dce02fdc467f0b3f52086c177@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/ra6389b1b82108a3b6bbcd22979f7665fd437c2a3408c9509a15a9ca1@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r413e380088c427f56102968df89ef2f336473e1b56b7d4b3a571a378@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f@%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc@%3Cpluto-scm.portals.apache.org%3E","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gq28-h5vg-8prx","description":"Privilege escalation in spring security"},"relatedVulnerabilities":[{"id":"CVE-2021-22112","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-22112","date":"2026-10-10","epss":0.03286,"percentile":0.88152}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/7","https://lists.apache.org/thread.html/r163b3e4e39803882f5be05ee8606b2b9812920e196daa2a82997ce14%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r2cb05e499807900ba23e539643eead9c5f0652fd271f223f89da1804%40%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/r37423ec7eea340e92a409452c35b649dce02fdc467f0b3f52086c177%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r3868207b967f926819fe3aa8d33f1666429be589bb4a62104a49f4e3%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r390783b3b1c59b978131ac08390bf77fbb3863270cbde59d5b0f5fde%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r413e380088c427f56102968df89ef2f336473e1b56b7d4b3a571a378%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/r89aa1b48a827f5641310305214547f1d6b2101971a49b624737c497f%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/ra53677224fe4f04c2599abc88032076faa18dc84b329cdeba85d4cfc%40%3Cpluto-scm.portals.apache.org%3E","https://lists.apache.org/thread.html/ra6389b1b82108a3b6bbcd22979f7665fd437c2a3408c9509a15a9ca1%40%3Cpluto-dev.portals.apache.org%3E","https://lists.apache.org/thread.html/redbd004a503b3520ae5746c2ab5e93fd7da807a8c128e60d2002cd9b%40%3Cissues.nifi.apache.org%3E","https://tanzu.vmware.com/security/cve-2021-22112","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-22112","description":"Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application."}]},{"artifact":{"id":"bd48d4e9babf1471","cpes":["cpe:2.3:a:curl:curl:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/debian/curl@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u14"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-16890","versionConstraint":"< 7.38.0-4+deb8u14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16890","fix":{"state":"fixed","versions":["7.38.0-4+deb8u14"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-16890","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16890","date":"2026-10-10","epss":0.05351,"percentile":0.92445}],"risk":2.6755,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16890"},"relatedVulnerabilities":[{"id":"CVE-2018-16890","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-16890","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16890","date":"2026-10-10","epss":0.05351,"percentile":0.92445}],"urls":["http://www.securityfocus.com/bid/106947","https://access.redhat.com/errata/RHSA-2019:3701","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-16890.html","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0001/","https://support.f5.com/csp/article/K03314397?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3882-1/","https://www.debian.org/security/2019/dsa-4386","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16890","description":"libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds."}]},{"artifact":{"id":"b18bf0d27c2a6f51","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.38.0-4\\+deb8u3:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/debian/libcurl3@7.38.0-4%2Bdeb8u3?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u3","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16890","versionConstraint":"< 7.38.0-4+deb8u14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u3"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16890","fix":{"state":"fixed","versions":["7.38.0-4+deb8u14"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-16890","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16890","date":"2026-10-10","epss":0.05351,"percentile":0.92445}],"risk":2.6755,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16890"},"relatedVulnerabilities":[{"id":"CVE-2018-16890","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-16890","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16890","date":"2026-10-10","epss":0.05351,"percentile":0.92445}],"urls":["http://www.securityfocus.com/bid/106947","https://access.redhat.com/errata/RHSA-2019:3701","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-16890.html","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0001/","https://support.f5.com/csp/article/K03314397?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3882-1/","https://www.debian.org/security/2019/dsa-4386","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16890","description":"libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds."}]},{"artifact":{"id":"91def6b718c26029","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.38.0-4\\+deb8u4:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/debian/libcurl3-gnutls@7.38.0-4%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=curl","type":"deb","version":"7.38.0-4+deb8u4","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.38.0-4+deb8u14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16890","versionConstraint":"< 7.38.0-4+deb8u14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"curl","version":"7.38.0-4+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-16890","fix":{"state":"fixed","versions":["7.38.0-4+deb8u14"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7.38.0-4+deb8u14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-16890","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16890","date":"2026-10-10","epss":0.05351,"percentile":0.92445}],"risk":2.6755,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-16890"},"relatedVulnerabilities":[{"id":"CVE-2018-16890","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16890","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-16890","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16890","date":"2026-10-10","epss":0.05351,"percentile":0.92445}],"urls":["http://www.securityfocus.com/bid/106947","https://access.redhat.com/errata/RHSA-2019:3701","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16890","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-16890.html","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://security.netapp.com/advisory/ntap-20190315-0001/","https://support.f5.com/csp/article/K03314397?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3882-1/","https://www.debian.org/security/2019/dsa-4386","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16890","description":"libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. The function handling incoming NTLM type-2 messages (`lib/vauth/ntlm.c:ntlm_decode_type2_target`) does not validate incoming data correctly and is subject to an integer overflow vulnerability. Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds."}]},{"artifact":{"id":"d43082fa89b8e644","cpes":["cpe:2.3:a:apache:mina-core:2.0.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:mina_core:2.0.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:core:2.0.9:*:*:*:*:*:*:*","cpe:2.3:a:apache:mina:2.0.9:*:*:*:*:*:*:*"],"name":"mina-core","purl":"pkg:maven/org.apache.mina/mina-core@2.0.9","type":"java-archive","version":"2.0.9","language":"java","licenses":["http://www.apache.org/licenses/LICENSE-2.0"],"metadata":{"pomGroupID":"org.apache.mina","virtualPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:stash-ssh-3.11.4.jar:META-INF/lib/mina-core-2.0.9.jar","manifestName":"","pomArtifactID":"mina-core","archiveDigests":[{"value":"255f546277515f2191105e89f4d768e3ca02db9c","algorithm":"sha1"}]},"locations":[{"path":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip","layerID":"sha256:da4bc765a30744d55a40fadb6b58e5099c50c735013cb7c8a7f45f2e6198b5e8","accessPath":"/opt/atlassian/stash/atlassian-stash/WEB-INF/classes/stash-bundled-plugins.zip:stash-ssh-3.11.4.jar:META-INF/lib/mina-core-2.0.9.jar","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"JavaMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.0.22"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-6mcm-j9cj-3vc3","versionConstraint":"<2.0.22 (unknown)"},"matcher":"java-matcher","searchedBy":{"package":{"name":"org.apache.mina:mina-core","version":"2.0.9"},"language":"java","namespace":"github:language:java"}}],"vulnerability":{"id":"GHSA-6mcm-j9cj-3vc3","fix":{"state":"fixed","versions":["2.0.22"],"available":[{"date":"2022-05-03","kind":"first-observed","version":"2.0.22"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-41973","cwe":"CWE-835","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-41973","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-41973","date":"2026-10-10","epss":0.04634,"percentile":0.91491}],"risk":2.6645499999999998,"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-41973","https://lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.apache.org%3E","http://www.openwall.com/lists/oss-security/2021/11/01/2","http://www.openwall.com/lists/oss-security/2021/11/01/8","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"github:language:java","advisories":[],"dataSource":"https://github.com/advisories/GHSA-6mcm-j9cj-3vc3","description":"Infinite loop in Apache MINA"},"relatedVulnerabilities":[{"id":"CVE-2021-41973","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-41973","cwe":"CWE-835","type":"Secondary","source":"security@apache.org"},{"cve":"CVE-2021-41973","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-41973","date":"2026-10-10","epss":0.04634,"percentile":0.91491}],"urls":["http://www.openwall.com/lists/oss-security/2021/11/01/2","http://www.openwall.com/lists/oss-security/2021/11/01/8","https://lists.apache.org/thread.html/r0b907da9340d5ff4e6c1a4798ef4e79700a668657f27cca8a39e9250%40%3Cdev.mina.apache.org%3E","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-41973","description":"In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater."}]},{"artifact":{"id":"2d59f7478c0a2886","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-2\\+b1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/debian/zlib1g@1%3A1.2.8.dfsg-2%2Bb1?arch=amd64&distro=debian-8.5&upstream=zlib%401%3A1.2.8.dfsg-2","type":"deb","version":"1:1.2.8.dfsg-2+b1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib","version":"1:1.2.8.dfsg-2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.2.8.dfsg-2+deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9842","versionConstraint":"< 1:1.2.8.dfsg-2+deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-9842","fix":{"state":"fixed","versions":["1:1.2.8.dfsg-2+deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1:1.2.8.dfsg-2+deb8u1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-9842","cwe":"CWE-1335","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9842","date":"2026-10-10","epss":0.05204,"percentile":0.92288}],"risk":2.6020000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-9842"},"relatedVulnerabilities":[{"id":"CVE-2016-9842","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9842","cwe":"CWE-1335","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-9842","date":"2026-10-10","epss":0.05204,"percentile":0.92288}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-12/msg00127.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00050.html","http://lists.opensuse.org/opensuse-updates/2017-01/msg00053.html","http://www.openwall.com/lists/oss-security/2016/12/05/21","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/95131","http://www.securitytracker.com/id/1039427","https://access.redhat.com/errata/RHSA-2017:1220","https://access.redhat.com/errata/RHSA-2017:1221","https://access.redhat.com/errata/RHSA-2017:1222","https://access.redhat.com/errata/RHSA-2017:2999","https://access.redhat.com/errata/RHSA-2017:3046","https://access.redhat.com/errata/RHSA-2017:3047","https://access.redhat.com/errata/RHSA-2017:3453","https://bugzilla.redhat.com/show_bug.cgi?id=1402348","https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958","https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html","https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html","https://security.gentoo.org/glsa/201701-56","https://security.gentoo.org/glsa/202007-54","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://usn.ubuntu.com/4246-1/","https://usn.ubuntu.com/4292-1/","https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#zlib","https://wiki.mozilla.org/images/0/09/Zlib-report.pdf","https://www.oracle.com/security-alerts/cpujul2020.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9842","description":"The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving left shifts of negative integers."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2800","versionConstraint":"< 7u181-2.6.14-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-2800","fix":{"state":"fixed","versions":["7u181-2.6.14-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u181-2.6.14-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2800","date":"2026-10-10","epss":0.05204,"percentile":0.92287}],"risk":2.6020000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4225-1","link":"https://security-tracker.debian.org/tracker/DSA-4225-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-2800"},"relatedVulnerabilities":[{"id":"CVE-2018-2800","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2800","date":"2026-10-10","epss":0.05204,"percentile":0.92287}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103849","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://access.redhat.com/errata/RHSA-2018:1721","https://access.redhat.com/errata/RHSA-2018:1722","https://access.redhat.com/errata/RHSA-2018:1723","https://access.redhat.com/errata/RHSA-2018:1724","https://access.redhat.com/errata/RHSA-2018:1974","https://access.redhat.com/errata/RHSA-2018:1975","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2800","description":"Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u181, 7u171 and 8u162; JRockit: R28.3.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, JRockit accessible data as well as unauthorized read access to a subset of Java SE, JRockit accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u181-2.6.14-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-2815","versionConstraint":"< 7u181-2.6.14-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2018-2815","fix":{"state":"fixed","versions":["7u181-2.6.14-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u181-2.6.14-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2018-2815","date":"2026-10-10","epss":0.05139,"percentile":0.92208}],"risk":2.5695,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-4225-1","link":"https://security-tracker.debian.org/tracker/DSA-4225-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-2815"},"relatedVulnerabilities":[{"id":"CVE-2018-2815","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-2815","date":"2026-10-10","epss":0.05139,"percentile":0.92208}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.securityfocus.com/bid/103848","http://www.securitytracker.com/id/1040697","https://access.redhat.com/errata/RHSA-2018:1188","https://access.redhat.com/errata/RHSA-2018:1191","https://access.redhat.com/errata/RHSA-2018:1201","https://access.redhat.com/errata/RHSA-2018:1202","https://access.redhat.com/errata/RHSA-2018:1203","https://access.redhat.com/errata/RHSA-2018:1204","https://access.redhat.com/errata/RHSA-2018:1205","https://access.redhat.com/errata/RHSA-2018:1206","https://access.redhat.com/errata/RHSA-2018:1270","https://access.redhat.com/errata/RHSA-2018:1278","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://security.gentoo.org/glsa/201903-14","https://security.netapp.com/advisory/ntap-20180419-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03857en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03915en_us","https://usn.ubuntu.com/3644-1/","https://usn.ubuntu.com/3691-1/","https://www.debian.org/security/2018/dsa-4185","https://www.debian.org/security/2018/dsa-4225"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-2815","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization). Supported versions that are affected are Java SE: 6u181, 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"265543fdc7f1a1aa","cpes":["cpe:2.3:a:libpng12-0:libpng12-0:1.2.50-2\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libpng12-0:libpng12_0:1.2.50-2\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libpng12_0:libpng12-0:1.2.50-2\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libpng12_0:libpng12_0:1.2.50-2\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libpng12:libpng12-0:1.2.50-2\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libpng12:libpng12_0:1.2.50-2\\+deb8u2:*:*:*:*:*:*:*"],"name":"libpng12-0","purl":"pkg:deb/debian/libpng12-0@1.2.50-2%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=libpng","type":"deb","version":"1.2.50-2+deb8u2","language":"","licenses":["sha256:265723d3bf6c4f4664caac889c62d7155c064713ad56b87a277104a879af273a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpng12-0/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libpng12-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpng12-0:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libpng12-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libpng"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.2.50-2+deb8u3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10087","versionConstraint":"< 1.2.50-2+deb8u3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libpng","version":"1.2.50-2+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-10087","fix":{"state":"fixed","versions":["1.2.50-2+deb8u3"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.2.50-2+deb8u3"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-10087","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10087","date":"2026-10-10","epss":0.05131,"percentile":0.92199}],"risk":2.5655,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-10087"},"relatedVulnerabilities":[{"id":"CVE-2016-10087","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10087","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-10087","date":"2026-10-10","epss":0.05131,"percentile":0.92199}],"urls":["http://www.openwall.com/lists/oss-security/2016/12/29/2","http://www.openwall.com/lists/oss-security/2016/12/30/4","http://www.securityfocus.com/bid/95157","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201701-74","https://usn.ubuntu.com/3712-1/","https://usn.ubuntu.com/3712-2/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10087","description":"The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure."}]},{"artifact":{"id":"d91ce551dcf6c33f","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/debian/libc-bin@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-10","epss":0.51298,"percentile":0.98915}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-10","epss":0.51298,"percentile":0.98915}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"495e1452a66e5099","cpes":["cpe:2.3:a:libc6:libc6:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/debian/libc6@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-10","epss":0.51298,"percentile":0.98915}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-10","epss":0.51298,"percentile":0.98915}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"6dec8d97d34362ed","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-18\\+deb8u4:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-18\\+deb8u4:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/debian/multiarch-support@2.19-18%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=glibc","type":"deb","version":"2.19-18+deb8u4","language":"","licenses":["sha256:2d02719572f86ede2b976e920bd35643ca039d6c9a6ed4ce2f647871dd97efb3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2010-4052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"glibc","version":"2.19-18+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2010-4052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-10","epss":0.51298,"percentile":0.98915}],"risk":2.5649,"urls":[],"severity":"Negligible","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4052"},"relatedVulnerabilities":[{"id":"CVE-2010-4052","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2010-4052","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2010-4052","date":"2026-10-10","epss":0.51298,"percentile":0.98915}],"urls":["http://cxib.net/stuff/proftpd.gnu.c","http://seclists.org/fulldisclosure/2011/Jan/78","http://secunia.com/advisories/42547","http://securityreason.com/achievement_securityalert/93","http://securityreason.com/securityalert/8003","http://securitytracker.com/id?1024832","http://www.exploit-db.com/exploits/15935","http://www.kb.cert.org/vuls/id/912279","http://www.securityfocus.com/archive/1/515589/100/0/threaded","http://www.securityfocus.com/bid/45233","https://bugzilla.redhat.com/show_bug.cgi?id=645859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4052","description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3860","versionConstraint":"< 1.4.3-4.1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3860","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u5"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3860","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3860","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3860","date":"2026-10-10","epss":0.05118,"percentile":0.92185}],"risk":2.559,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3860"},"relatedVulnerabilities":[{"id":"CVE-2019-3860","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3860","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3860","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3860","date":"2026-10-10","epss":0.05118,"percentile":0.92185}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00072.html","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3860","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://seclists.org/bugtraq/2019/Apr/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3860.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3860","description":"An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFTP packets with empty payloads are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory."}]},{"artifact":{"id":"6b0a2bec2a5ddc0d","cpes":["cpe:2.3:a:libssh2-1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2-1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2_1:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2-1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:libssh2:libssh2_1:1.4.3-4.1\\+deb8u1:*:*:*:*:*:*:*"],"name":"libssh2-1","purl":"pkg:deb/debian/libssh2-1@1.4.3-4.1%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=libssh2","type":"deb","version":"1.4.3-4.1+deb8u1","language":"","licenses":["BSD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssh2-1/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libssh2-1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libssh2-1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libssh2"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.3-4.1+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3861","versionConstraint":"< 1.4.3-4.1+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libssh2","version":"1.4.3-4.1+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-3861","fix":{"state":"fixed","versions":["1.4.3-4.1+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"1.4.3-4.1+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-3861","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3861","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3861","date":"2026-10-10","epss":0.05118,"percentile":0.92185}],"risk":2.559,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-3861"},"relatedVulnerabilities":[{"id":"CVE-2019-3861","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-3861","cwe":"CWE-125","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2019-3861","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-3861","date":"2026-10-10","epss":0.05118,"percentile":0.92185}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html","https://access.redhat.com/errata/RHSA-2019:2136","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3861","https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/","https://seclists.org/bugtraq/2019/Apr/25","https://security.netapp.com/advisory/ntap-20190327-0005/","https://www.debian.org/security/2019/dsa-4431","https://www.libssh2.org/CVE-2019-3861.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3861","description":"An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory."}]},{"artifact":{"id":"d4a4e53150a9623c","cpes":["cpe:2.3:a:libnss3:libnss3:2\\:3.17.2-1.1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libnss3","purl":"pkg:deb/debian/libnss3@2%3A3.17.2-1.1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=nss","type":"deb","version":"2:3.17.2-1.1+deb8u2","language":"","licenses":["HPND","HPND-sell-variant","MIT","MPL-2.0","Zlib","blessing"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnss3/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/libnss3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnss3:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/libnss3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nss"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:3.26-1+debu8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2834","versionConstraint":"< 2:3.26-1+debu8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"nss","version":"2:3.17.2-1.1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-2834","fix":{"state":"fixed","versions":["2:3.26-1+debu8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2:3.26-1+debu8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2016-2834","date":"2026-10-10","epss":0.0338,"percentile":0.88474}],"risk":2.5349999999999997,"urls":[],"severity":"High","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3688-1","link":"https://security-tracker.debian.org/tracker/DSA-3688-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-2834"},"relatedVulnerabilities":[{"id":"CVE-2016-2834","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-2834","date":"2026-10-10","epss":0.0338,"percentile":0.88474}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00014.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00016.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2779.html","http://www.debian.org/security/2016/dsa-3688","http://www.mozilla.org/security/announce/2016/mfsa2016-61.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/91072","http://www.securitytracker.com/id/1036057","http://www.ubuntu.com/usn/USN-2993-1","http://www.ubuntu.com/usn/USN-3029-1","https://bugzilla.mozilla.org/show_bug.cgi?id=1206283","https://bugzilla.mozilla.org/show_bug.cgi?id=1221620","https://bugzilla.mozilla.org/show_bug.cgi?id=1241034","https://bugzilla.mozilla.org/show_bug.cgi?id=1241037","https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.23_release_notes"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2834","description":"Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u151-2.6.11-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-10176","versionConstraint":"< 7u151-2.6.11-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10176","fix":{"state":"fixed","versions":["7u151-2.6.11-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u151-2.6.11-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2017-10176","date":"2026-10-10","epss":0.05034,"percentile":0.9207}],"risk":2.5170000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[{"id":"DSA-3954-1","link":"https://security-tracker.debian.org/tracker/DSA-3954-1"}],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10176"},"relatedVulnerabilities":[{"id":"CVE-2017-10176","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-10176","date":"2026-10-10","epss":0.05034,"percentile":0.9207}],"urls":["http://www.debian.org/security/2017/dsa-3919","http://www.debian.org/security/2017/dsa-3954","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.securityfocus.com/bid/99788","http://www.securitytracker.com/id/1038931","https://access.redhat.com/errata/RHSA-2017:1790","https://access.redhat.com/errata/RHSA-2017:1791","https://cert.vde.com/en-us/advisories/vde-2017-002","https://security.gentoo.org/glsa/201709-22","https://security.netapp.com/advisory/ntap-20170720-0001/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10176","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security). Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"999754bfd5d89f7c","cpes":["cpe:2.3:a:libpcre3:libpcre3:2\\:8.35-3.3\\+deb8u4:*:*:*:*:*:*:*"],"name":"libpcre3","purl":"pkg:deb/debian/libpcre3@2%3A8.35-3.3%2Bdeb8u4?arch=amd64&distro=debian-8.5&upstream=pcre3","type":"deb","version":"2:8.35-3.3+deb8u4","language":"","licenses":["sha256:ac9276490d2fa167442ae1aae33926514ad10c8886baa40046c5e367fccc5938"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre3/copyright","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/usr/share/doc/libpcre3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","layerID":"sha256:2f71b45e4e254ddceb187b1467f5471f0e14d7124ac2dd7fdd7ddbc76e13f0e5","accessPath":"/var/lib/dpkg/info/libpcre3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-7186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"pcre3","version":"2:8.35-3.3+deb8u4"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-7186","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-7186","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7186","date":"2026-10-10","epss":0.05033,"percentile":0.92069}],"risk":2.5165,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-7186"},"relatedVulnerabilities":[{"id":"CVE-2017-7186","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7186","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7186","date":"2026-10-10","epss":0.05033,"percentile":0.92069}],"urls":["http://www.securityfocus.com/bid/97030","https://access.redhat.com/errata/RHSA-2018:2486","https://blogs.gentoo.org/ago/2017/03/14/libpcre-invalid-memory-read-in-match-pcre_exec-c/","https://bugs.exim.org/show_bug.cgi?id=2052","https://security.gentoo.org/glsa/201710-09","https://security.gentoo.org/glsa/201710-25","https://vcs.pcre.org/pcre/code/trunk/pcre_internal.h?r1=1649&r2=1688&sortby=date","https://vcs.pcre.org/pcre/code/trunk/pcre_ucd.c?r1=1490&r2=1688&sortby=date","https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_internal.h?r1=600&r2=670&sortby=date","https://vcs.pcre.org/pcre2/code/trunk/src/pcre2_ucd.c?r1=316&r2=670&sortby=date"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7186","description":"libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote attackers to cause a denial of service (segmentation violation for read access, and application crash) by triggering an invalid Unicode property lookup."}]},{"artifact":{"id":"3266613933064841","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.40\\+dfsg-1\\+deb8u2:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/debian/libldap-2.4-2@2.4.40%2Bdfsg-1%2Bdeb8u2?arch=amd64&distro=debian-8.5&upstream=openldap","type":"deb","version":"2.4.40+dfsg-1+deb8u2","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.40+dfsg-1+deb8u5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-13565","versionConstraint":"< 2.4.40+dfsg-1+deb8u5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openldap","version":"2.4.40+dfsg-1+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2019-13565","fix":{"state":"fixed","versions":["2.4.40+dfsg-1+deb8u5"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.4.40+dfsg-1+deb8u5"}]},"cvss":[],"epss":[{"cve":"CVE-2019-13565","date":"2026-10-10","epss":0.05015,"percentile":0.92048}],"risk":2.5075,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-13565"},"relatedVulnerabilities":[{"id":"CVE-2019-13565","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-13565","date":"2026-10-10","epss":0.05015,"percentile":0.92048}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html","http://seclists.org/fulldisclosure/2019/Dec/26","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/08/msg00024.html","https://seclists.org/bugtraq/2019/Dec/23","https://support.apple.com/kb/HT210788","https://support.f5.com/csp/article/K98008862?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4078-1/","https://usn.ubuntu.com/4078-2/","https://www.openldap.org/its/index.cgi/?findid=9052","https://www.openldap.org/lists/openldap-announce/201907/msg00001.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-13565","description":"An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user."}]},{"artifact":{"id":"fccd7005612c4c3f","cpes":["cpe:2.3:a:libhogweed2:libhogweed2:2.7.1-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"libhogweed2","purl":"pkg:deb/debian/libhogweed2@2.7.1-5%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=nettle","type":"deb","version":"2.7.1-5+deb8u1","language":"","licenses":["sha256:cd196d0a3ae2ff53dfd5168f087ae9583b7ae5c8290f4a918357967db8dd3fcb"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnettle4/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libhogweed2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libhogweed2:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libhogweed2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nettle"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.1-5+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6489","versionConstraint":"< 2.7.1-5+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"nettle","version":"2.7.1-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6489","fix":{"state":"fixed","versions":["2.7.1-5+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.7.1-5+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6489","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6489","date":"2026-10-10","epss":0.05007,"percentile":0.92037}],"risk":2.5035000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6489"},"relatedVulnerabilities":[{"id":"CVE-2016-6489","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6489","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6489","date":"2026-10-10","epss":0.05007,"percentile":0.92037}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-2582.html","http://www.openwall.com/lists/oss-security/2016/07/29/7","http://www.ubuntu.com/usn/USN-3193-1","https://bugzilla.redhat.com/show_bug.cgi?id=1362016","https://eprint.iacr.org/2016/596.pdf","https://git.lysator.liu.se/nettle/nettle/commit/3fe1d6549765ecfb24f0b80b2ed086fdc818bff3","https://security.gentoo.org/glsa/201706-21","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6489","description":"The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack."}]},{"artifact":{"id":"202f676882bd80bc","cpes":["cpe:2.3:a:libnettle4:libnettle4:2.7.1-5\\+deb8u1:*:*:*:*:*:*:*"],"name":"libnettle4","purl":"pkg:deb/debian/libnettle4@2.7.1-5%2Bdeb8u1?arch=amd64&distro=debian-8.5&upstream=nettle","type":"deb","version":"2.7.1-5+deb8u1","language":"","licenses":["sha256:cd196d0a3ae2ff53dfd5168f087ae9583b7ae5c8290f4a918357967db8dd3fcb"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libnettle4/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libnettle4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libnettle4:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libnettle4:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"nettle"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.7.1-5+deb8u2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6489","versionConstraint":"< 2.7.1-5+deb8u2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"nettle","version":"2.7.1-5+deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2016-6489","fix":{"state":"fixed","versions":["2.7.1-5+deb8u2"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"2.7.1-5+deb8u2"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6489","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6489","date":"2026-10-10","epss":0.05007,"percentile":0.92037}],"risk":2.5035000000000003,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2016-6489"},"relatedVulnerabilities":[{"id":"CVE-2016-6489","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6489","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6489","date":"2026-10-10","epss":0.05007,"percentile":0.92037}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-2582.html","http://www.openwall.com/lists/oss-security/2016/07/29/7","http://www.ubuntu.com/usn/USN-3193-1","https://bugzilla.redhat.com/show_bug.cgi?id=1362016","https://eprint.iacr.org/2016/596.pdf","https://git.lysator.liu.se/nettle/nettle/commit/3fe1d6549765ecfb24f0b80b2ed086fdc818bff3","https://security.gentoo.org/glsa/201706-21","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6489","description":"The RSA and DSA decryption code in Nettle makes it easier for attackers to discover private keys via a cache side channel attack."}]},{"artifact":{"id":"84c5f8ed479ca7e3","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.2-3\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.2-3\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.2-3\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.2-3\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.2-3\\+deb8u2:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.2-3\\+deb8u2:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/debian/libtasn1-6@4.2-3%2Bdeb8u2?arch=amd64&distro=debian-8.5","type":"deb","version":"4.2-3+deb8u2","language":"","licenses":["sha256:7faa7a2e10c1267fe75183ec4f0d556d78d9630f29e1a7e704d1f6d67041216f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:66d8e5ee400cb0660c8c0ad51d30d822365a995eb90d35750a1e641cae7c887c","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.2-3+deb8u4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-10790","versionConstraint":"< 4.2-3+deb8u4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"libtasn1-6","version":"4.2-3+deb8u2"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2017-10790","fix":{"state":"fixed","versions":["4.2-3+deb8u4"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"4.2-3+deb8u4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-10790","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10790","date":"2026-10-10","epss":0.0499,"percentile":0.92019}],"risk":2.495,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2017-10790"},"relatedVulnerabilities":[{"id":"CVE-2017-10790","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-10790","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-10790","date":"2026-10-10","epss":0.0499,"percentile":0.92019}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1464141","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/06/msg00026.html","https://security.gentoo.org/glsa/201710-11","https://usn.ubuntu.com/3547-1/","https://www.debian.org/security/2018/dsa-4106"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-10790","description":"The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure. It may lead to a remote denial of service attack."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u261-2.6.22-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-2781","versionConstraint":"< 7u261-2.6.22-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-2781","fix":{"state":"fixed","versions":["7u261-2.6.22-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u261-2.6.22-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2020-2781","date":"2026-10-10","epss":0.04948,"percentile":0.91957}],"risk":2.474,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-2781"},"relatedVulnerabilities":[{"id":"CVE-2020-2781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-2781","date":"2026-10-10","epss":0.04948,"percentile":0.91957}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10318","https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/","https://security.gentoo.org/glsa/202006-22","https://security.gentoo.org/glsa/202209-15","https://security.netapp.com/advisory/ntap-20200416-0004/","https://usn.ubuntu.com/4337-1/","https://www.debian.org/security/2020/dsa-4662","https://www.debian.org/security/2020/dsa-4668","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-2781","description":"Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"0c25643128e6288a","cpes":["cpe:2.3:a:openjdk-7-jre-headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre-headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre_headless:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7-jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7_jre:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk-7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk_7:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk-7-jre-headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*","cpe:2.3:a:openjdk:openjdk_7_jre_headless:7u111-2.6.7-1\\~deb8u1:*:*:*:*:*:*:*"],"name":"openjdk-7-jre-headless","purl":"pkg:deb/debian/openjdk-7-jre-headless@7u111-2.6.7-1~deb8u1?arch=amd64&distro=debian-8.5&upstream=openjdk-7","type":"deb","version":"7u111-2.6.7-1~deb8u1","language":"","licenses":["sha256:b4098de4a6f7616e7df6052cee9a13494fc1836e4ac46ed51350d9a91277c721"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:acbf1725c4f953a5c17f3b3f5529f67c6ef12a979a2509c8f47aeeaa97b37dda","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openjdk-7-jre-headless/copyright","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/usr/share/doc/openjdk-7-jre-headless/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","layerID":"sha256:903bf3d7e2ff645781889a26f8ded002c0fa262d54507eef2102fd2625d489a1","accessPath":"/var/lib/dpkg/info/openjdk-7-jre-headless:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openjdk-7"}]},"matchDetails":[{"fix":{"suggestedVersion":"7u261-2.6.22-1~deb8u1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-2830","versionConstraint":"< 7u261-2.6.22-1~deb8u1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"8.5"},"package":{"name":"openjdk-7","version":"7u111-2.6.7-1~deb8u1"},"namespace":"debian:distro:debian:8"}}],"vulnerability":{"id":"CVE-2020-2830","fix":{"state":"fixed","versions":["7u261-2.6.22-1~deb8u1"],"available":[{"date":"2026-02-27","kind":"first-observed","version":"7u261-2.6.22-1~deb8u1"}]},"cvss":[],"epss":[{"cve":"CVE-2020-2830","date":"2026-10-10","epss":0.04948,"percentile":0.91957}],"risk":2.474,"urls":[],"severity":"Medium","namespace":"debian:distro:debian:8","advisories":[],"dataSource":"https://security-tracker.debian.org/tracker/CVE-2020-2830"},"relatedVulnerabilities":[{"id":"CVE-2020-2830","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-2830","date":"2026-10-10","epss":0.04948,"percentile":0.91957}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00048.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10318","https://lists.debian.org/debian-lts-announce/2020/04/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CKAV6KFFAEANXAN73AFTGU7Z6YNRWCXQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7VHC4EW36KZEIDQ56RPCWBZCQELFFKN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYHHHZRHXCBGRHGE5UP7UEB4IZ2QX536/","https://security.gentoo.org/glsa/202006-22","https://security.netapp.com/advisory/ntap-20200416-0004/","https://usn.ubuntu.com/4337-1/","https://www.debian.org/security/2020/dsa-4662","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-2830","description":"Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency). Supported versions that are affected are Java SE: 7u251, 8u241, 11.0.6 and 14; Java SE Embedded: 8u241. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)."}]}],"grade":"F","score":"0.00","as_of":"2026-10-12T04:41:38.986Z","grype_db_version":"2026-10-11T06:30:42.000Z"}