{"grype_matches":[{"artifact":{"id":"328fe217962e5779","cpes":["cpe:2.3:a:sudo:sudo:1.8.9p5-1ubuntu1.2:*:*:*:*:*:*:*"],"name":"sudo","purl":"pkg:deb/ubuntu/sudo@1.8.9p5-1ubuntu1.2?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.8.9p5-1ubuntu1.2","language":"","licenses":["BSD-3-Clause","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/sudo/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/sudo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.list"},{"path":"/var/lib/dpkg/info/sudo.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.postinst"},{"path":"/var/lib/dpkg/info/sudo.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.postrm"},{"path":"/var/lib/dpkg/info/sudo.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.preinst"},{"path":"/var/lib/dpkg/info/sudo.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sudo","version":"1.8.9p5-1ubuntu1.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3156","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3156","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3156","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3156","date":"2026-10-07","epss":0.99962,"percentile":0.99976}],"risk":78.75000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3156","knownExploited":[{"cve":"CVE-2021-3156","cwes":["CWE-122","CWE-193"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-3156"],"dueDate":"2022-04-27","product":"Sudo","dateAdded":"2022-04-06","vendorProject":"Sudo","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2021-3156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3156","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3156","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3156","date":"2026-10-07","epss":0.99962,"percentile":0.99976}],"urls":["http://packetstormsecurity.com/files/161160/Sudo-Heap-Based-Buffer-Overflow.html","http://packetstormsecurity.com/files/161230/Sudo-Buffer-Overflow-Privilege-Escalation.html","http://packetstormsecurity.com/files/161270/Sudo-1.9.5p1-Buffer-Overflow-Privilege-Escalation.html","http://packetstormsecurity.com/files/161293/Sudo-1.8.31p2-1.9.5p1-Buffer-Overflow.html","http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html","http://seclists.org/fulldisclosure/2021/Feb/42","http://seclists.org/fulldisclosure/2021/Jan/79","http://seclists.org/fulldisclosure/2024/Feb/3","http://www.openwall.com/lists/oss-security/2021/01/26/3","http://www.openwall.com/lists/oss-security/2021/01/27/1","http://www.openwall.com/lists/oss-security/2021/01/27/2","http://www.openwall.com/lists/oss-security/2021/02/15/1","http://www.openwall.com/lists/oss-security/2021/09/14/2","http://www.openwall.com/lists/oss-security/2024/01/30/6","http://www.openwall.com/lists/oss-security/2024/01/30/8","https://kc.mcafee.com/corporate/index?page=content&id=SB10348","https://lists.debian.org/debian-lts-announce/2021/01/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CALA5FTXIQBRRYUA2ZQNJXB6OQMAXEII/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LHXK6ICO5AYLGFK2TAX5MZKUXTUKWOJY/","https://security.gentoo.org/glsa/202101-33","https://security.netapp.com/advisory/ntap-20210128-0001/","https://security.netapp.com/advisory/ntap-20210128-0002/","https://support.apple.com/kb/HT212177","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sudo-privesc-jan2021-qnYQfcM","https://www.beyondtrust.com/blog/entry/security-advisory-privilege-management-for-unix-linux-pmul-basic-and-privilege-management-for-mac-pmm-affected-by-sudo-vulnerability","https://www.debian.org/security/2021/dsa-4839","https://www.kb.cert.org/vuls/id/794544","https://www.openwall.com/lists/oss-security/2021/01/26/3","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.sudo.ws/stable.html#1.9.5p2","https://www.synology.com/security/advisory/Synology_SA_21_02","https://www.vicarius.io/vsociety/posts/sudoedit-pwned-cve-2021-3156","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-3156"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3156","description":"Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via \"sudoedit -s\" and a command-line argument that ends with a single backslash character.","knownExploited":[{"cve":"CVE-2021-3156","cwes":["CWE-122","CWE-193"],"urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-3156"],"dueDate":"2022-04-27","product":"Sudo","dateAdded":"2022-04-06","vendorProject":"Sudo","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-0778","date":"2026-10-07","epss":0.73188,"percentile":0.99448}],"risk":54.891,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0778"},"relatedVulnerabilities":[{"id":"CVE-2022-0778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-0778","date":"2026-10-07","epss":0.73188,"percentile":0.99448}],"urls":["http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html","http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3118eb64934499d93db3230748a452351d1d9a65","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=380085481c64de749a6dd25cdf0bcf4360b30f83","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a466912611aa6cbdf550cd10601390e587451246","https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html","https://lists.debian.org/debian-lts-announce/2022/03/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220321-0002/","https://security.netapp.com/advisory/ntap-20220429-0005/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5103","https://www.openssl.org/news/secadv/20220315.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.tenable.com/security/tns-2022-06","https://www.tenable.com/security/tns-2022-07","https://www.tenable.com/security/tns-2022-08","https://www.tenable.com/security/tns-2022-09","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-108696.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-712929.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0778","description":"The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc)."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-0778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-0778","date":"2026-10-07","epss":0.73188,"percentile":0.99448}],"risk":54.891,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0778"},"relatedVulnerabilities":[{"id":"CVE-2022-0778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-0778","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-0778","date":"2026-10-07","epss":0.73188,"percentile":0.99448}],"urls":["http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html","http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3118eb64934499d93db3230748a452351d1d9a65","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=380085481c64de749a6dd25cdf0bcf4360b30f83","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a466912611aa6cbdf550cd10601390e587451246","https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html","https://lists.debian.org/debian-lts-announce/2022/03/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220321-0002/","https://security.netapp.com/advisory/ntap-20220429-0005/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5103","https://www.openssl.org/news/secadv/20220315.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.tenable.com/security/tns-2022-06","https://www.tenable.com/security/tns-2022-07","https://www.tenable.com/security/tns-2022-08","https://www.tenable.com/security/tns-2022-09","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-108696.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-712929.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0778","description":"The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc)."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-2068","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-2068","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2068","date":"2026-10-07","epss":0.95404,"percentile":0.99869}],"risk":47.702,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-2068"},"relatedVulnerabilities":[{"id":"CVE-2022-2068","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2068","date":"2026-10-07","epss":0.95404,"percentile":0.99869}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2c9c35870601b4a44d86ddbf512b38df38285cfa","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7a9c027159fe9e1bbc2cd38a8a2914bff0d5abd9","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9639817dac8bbbaa64d09efad7464ccc405527c7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WZZBKUHQFGSKGNXXKICSRPL7AMVW5M5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/","https://security.netapp.com/advisory/ntap-20220707-0008/","https://www.debian.org/security/2022/dsa-5169","https://www.openssl.org/news/secadv/20220621.txt","http://seclists.org/fulldisclosure/2024/Nov/0","https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2068","description":"In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-2068","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-2068","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2068","date":"2026-10-07","epss":0.95404,"percentile":0.99869}],"risk":47.702,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-2068"},"relatedVulnerabilities":[{"id":"CVE-2022-2068","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-2068","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-2068","date":"2026-10-07","epss":0.95404,"percentile":0.99869}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2c9c35870601b4a44d86ddbf512b38df38285cfa","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7a9c027159fe9e1bbc2cd38a8a2914bff0d5abd9","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9639817dac8bbbaa64d09efad7464ccc405527c7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WZZBKUHQFGSKGNXXKICSRPL7AMVW5M5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/","https://security.netapp.com/advisory/ntap-20220707-0008/","https://www.debian.org/security/2022/dsa-5169","https://www.openssl.org/news/secadv/20220621.txt","http://seclists.org/fulldisclosure/2024/Nov/0","https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-2068","description":"In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6304","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6304","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6304","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6304","date":"2026-10-07","epss":0.63029,"percentile":0.99184}],"risk":47.271750000000004,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6304"},"relatedVulnerabilities":[{"id":"CVE-2016-6304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6304","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6304","date":"2026-10-07","epss":0.63029,"percentile":0.99184}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://rhn.redhat.com/errata/RHSA-2016-2802.html","http://rhn.redhat.com/errata/RHSA-2017-1415.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/fulldisclosure/2016/Dec/47","http://seclists.org/fulldisclosure/2016/Oct/62","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/93150","http://www.securitytracker.com/id/1036878","http://www.securitytracker.com/id/1037640","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2017:1413","https://access.redhat.com/errata/RHSA-2017:1414","https://access.redhat.com/errata/RHSA-2017:1658","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.openssl.org/news/secadv/20160922.txt","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6304","description":"Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6304","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6304","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6304","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6304","date":"2026-10-07","epss":0.63029,"percentile":0.99184}],"risk":47.271750000000004,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6304"},"relatedVulnerabilities":[{"id":"CVE-2016-6304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6304","cwe":"CWE-401","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6304","date":"2026-10-07","epss":0.63029,"percentile":0.99184}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://rhn.redhat.com/errata/RHSA-2016-2802.html","http://rhn.redhat.com/errata/RHSA-2017-1415.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/fulldisclosure/2016/Dec/47","http://seclists.org/fulldisclosure/2016/Oct/62","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/93150","http://www.securitytracker.com/id/1036878","http://www.securitytracker.com/id/1037640","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2017:1413","https://access.redhat.com/errata/RHSA-2017:1414","https://access.redhat.com/errata/RHSA-2017:1658","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.openssl.org/news/secadv/20160922.txt","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6304","description":"Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions."}]},{"artifact":{"id":"3695a31b2933dc8f","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-48795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-48795","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-48795","date":"2026-10-07","epss":0.93547,"percentile":0.9984}],"risk":46.7735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-48795"},"relatedVulnerabilities":[{"id":"CVE-2023-48795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-48795","date":"2026-10-07","epss":0.93547,"percentile":0.9984}],"urls":["http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html","http://seclists.org/fulldisclosure/2024/Mar/21","http://www.openwall.com/lists/oss-security/2023/12/18/3","http://www.openwall.com/lists/oss-security/2023/12/19/5","http://www.openwall.com/lists/oss-security/2023/12/20/3","http://www.openwall.com/lists/oss-security/2024/03/06/3","http://www.openwall.com/lists/oss-security/2024/04/17/8","https://access.redhat.com/security/cve/cve-2023-48795","https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/","https://bugs.gentoo.org/920280","https://bugzilla.redhat.com/show_bug.cgi?id=2254210","https://bugzilla.suse.com/show_bug.cgi?id=1217950","https://crates.io/crates/thrussh/versions","https://filezilla-project.org/versions.php","https://forum.netgate.com/topic/184941/terrapin-ssh-attack","https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6","https://github.com/NixOS/nixpkgs/pull/275249","https://github.com/PowerShell/Win32-OpenSSH/issues/2189","https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta","https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0","https://github.com/TeraTermProject/teraterm/releases/tag/v5.1","https://github.com/advisories/GHSA-45x7-px36-x8w8","https://github.com/apache/mina-sshd/issues/445","https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab","https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22","https://github.com/cyd01/KiTTY/issues/520","https://github.com/drakkan/sftpgo/releases/tag/v2.5.6","https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42","https://github.com/erlang/otp/releases/tag/OTP-26.2.1","https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d","https://github.com/hierynomus/sshj/issues/916","https://github.com/janmojzis/tinyssh/issues/81","https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5","https://github.com/libssh2/libssh2/pull/1291","https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25","https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3","https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15","https://github.com/mwiede/jsch/issues/457","https://github.com/mwiede/jsch/pull/461","https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16","https://github.com/openssh/openssh-portable/commits/master","https://github.com/paramiko/paramiko/issues/2337","https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES","https://github.com/proftpd/proftpd/issues/456","https://github.com/rapier1/hpn-ssh/releases","https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst","https://github.com/ronf/asyncssh/tags","https://github.com/ssh-mitm/ssh-mitm/issues/165","https://github.com/warp-tech/russh/releases/tag/v0.40.2","https://gitlab.com/libssh/libssh-mirror/-/tags","https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ","https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg","https://help.panic.com/releasenotes/transmit5/","https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/","https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html","https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/","https://matt.ucc.asn.au/dropbear/CHANGES","https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC","https://news.ycombinator.com/item?id=38684904","https://news.ycombinator.com/item?id=38685286","https://news.ycombinator.com/item?id=38732005","https://nova.app/releases/#v11.8","https://oryx-embedded.com/download/#changelog","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002","https://roumenpetrov.info/secsh/#news20231220","https://security-tracker.debian.org/tracker/CVE-2023-48795","https://security-tracker.debian.org/tracker/source-package/libssh2","https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg","https://security-tracker.debian.org/tracker/source-package/trilead-ssh2","https://security.gentoo.org/glsa/202312-16","https://security.gentoo.org/glsa/202312-17","https://security.netapp.com/advisory/ntap-20240105-0004/","https://support.apple.com/kb/HT214084","https://thorntech.com/cve-2023-48795-and-sftp-gateway/","https://twitter.com/TrueSkrillor/status/1736774389725565005","https://ubuntu.com/security/CVE-2023-48795","https://winscp.net/eng/docs/history#6.2.2","https://www.bitvise.com/ssh-client-version-history#933","https://www.bitvise.com/ssh-server-version-history","https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update","https://www.debian.org/security/2023/dsa-5586","https://www.debian.org/security/2023/dsa-5588","https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc","https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508","https://www.netsarang.com/en/xshell-update-history/","https://www.openssh.com/openbsd.html","https://www.openssh.com/txt/release-9.6","https://www.openwall.com/lists/oss-security/2023/12/18/2","https://www.openwall.com/lists/oss-security/2023/12/20/3","https://www.paramiko.org/changelog.html","https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/","https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/","https://www.terrapin-attack.com","https://www.theregister.com/2023/12/20/terrapin_attack_ssh","https://www.vandyke.com/products/securecrt/history.txt","https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://www.vicarius.io/vsociety/posts/cve-2023-48795-detect-openssh-vulnerabilit","https://www.vicarius.io/vsociety/posts/cve-2023-48795-mitigate-openssh-vulnerability","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795","description":"The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust."}]},{"artifact":{"id":"54d7c6e40533c708","cpes":["cpe:2.3:a:openssh-server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-server","purl":"pkg:deb/ubuntu/openssh-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.config","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.config"},{"path":"/var/lib/dpkg/info/openssh-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.list"},{"path":"/var/lib/dpkg/info/openssh-server.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postinst"},{"path":"/var/lib/dpkg/info/openssh-server.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postrm"},{"path":"/var/lib/dpkg/info/openssh-server.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.preinst"},{"path":"/var/lib/dpkg/info/openssh-server.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.prerm"},{"path":"/var/lib/dpkg/info/openssh-server.templates","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.templates"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-48795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-48795","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-48795","date":"2026-10-07","epss":0.93547,"percentile":0.9984}],"risk":46.7735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-48795"},"relatedVulnerabilities":[{"id":"CVE-2023-48795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-48795","date":"2026-10-07","epss":0.93547,"percentile":0.9984}],"urls":["http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html","http://seclists.org/fulldisclosure/2024/Mar/21","http://www.openwall.com/lists/oss-security/2023/12/18/3","http://www.openwall.com/lists/oss-security/2023/12/19/5","http://www.openwall.com/lists/oss-security/2023/12/20/3","http://www.openwall.com/lists/oss-security/2024/03/06/3","http://www.openwall.com/lists/oss-security/2024/04/17/8","https://access.redhat.com/security/cve/cve-2023-48795","https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/","https://bugs.gentoo.org/920280","https://bugzilla.redhat.com/show_bug.cgi?id=2254210","https://bugzilla.suse.com/show_bug.cgi?id=1217950","https://crates.io/crates/thrussh/versions","https://filezilla-project.org/versions.php","https://forum.netgate.com/topic/184941/terrapin-ssh-attack","https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6","https://github.com/NixOS/nixpkgs/pull/275249","https://github.com/PowerShell/Win32-OpenSSH/issues/2189","https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta","https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0","https://github.com/TeraTermProject/teraterm/releases/tag/v5.1","https://github.com/advisories/GHSA-45x7-px36-x8w8","https://github.com/apache/mina-sshd/issues/445","https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab","https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22","https://github.com/cyd01/KiTTY/issues/520","https://github.com/drakkan/sftpgo/releases/tag/v2.5.6","https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42","https://github.com/erlang/otp/releases/tag/OTP-26.2.1","https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d","https://github.com/hierynomus/sshj/issues/916","https://github.com/janmojzis/tinyssh/issues/81","https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5","https://github.com/libssh2/libssh2/pull/1291","https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25","https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3","https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15","https://github.com/mwiede/jsch/issues/457","https://github.com/mwiede/jsch/pull/461","https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16","https://github.com/openssh/openssh-portable/commits/master","https://github.com/paramiko/paramiko/issues/2337","https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES","https://github.com/proftpd/proftpd/issues/456","https://github.com/rapier1/hpn-ssh/releases","https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst","https://github.com/ronf/asyncssh/tags","https://github.com/ssh-mitm/ssh-mitm/issues/165","https://github.com/warp-tech/russh/releases/tag/v0.40.2","https://gitlab.com/libssh/libssh-mirror/-/tags","https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ","https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg","https://help.panic.com/releasenotes/transmit5/","https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/","https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html","https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/","https://matt.ucc.asn.au/dropbear/CHANGES","https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC","https://news.ycombinator.com/item?id=38684904","https://news.ycombinator.com/item?id=38685286","https://news.ycombinator.com/item?id=38732005","https://nova.app/releases/#v11.8","https://oryx-embedded.com/download/#changelog","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002","https://roumenpetrov.info/secsh/#news20231220","https://security-tracker.debian.org/tracker/CVE-2023-48795","https://security-tracker.debian.org/tracker/source-package/libssh2","https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg","https://security-tracker.debian.org/tracker/source-package/trilead-ssh2","https://security.gentoo.org/glsa/202312-16","https://security.gentoo.org/glsa/202312-17","https://security.netapp.com/advisory/ntap-20240105-0004/","https://support.apple.com/kb/HT214084","https://thorntech.com/cve-2023-48795-and-sftp-gateway/","https://twitter.com/TrueSkrillor/status/1736774389725565005","https://ubuntu.com/security/CVE-2023-48795","https://winscp.net/eng/docs/history#6.2.2","https://www.bitvise.com/ssh-client-version-history#933","https://www.bitvise.com/ssh-server-version-history","https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update","https://www.debian.org/security/2023/dsa-5586","https://www.debian.org/security/2023/dsa-5588","https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc","https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508","https://www.netsarang.com/en/xshell-update-history/","https://www.openssh.com/openbsd.html","https://www.openssh.com/txt/release-9.6","https://www.openwall.com/lists/oss-security/2023/12/18/2","https://www.openwall.com/lists/oss-security/2023/12/20/3","https://www.paramiko.org/changelog.html","https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/","https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/","https://www.terrapin-attack.com","https://www.theregister.com/2023/12/20/terrapin_attack_ssh","https://www.vandyke.com/products/securecrt/history.txt","https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://www.vicarius.io/vsociety/posts/cve-2023-48795-detect-openssh-vulnerabilit","https://www.vicarius.io/vsociety/posts/cve-2023-48795-mitigate-openssh-vulnerability","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795","description":"The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust."}]},{"artifact":{"id":"b3db4be88de03e2f","cpes":["cpe:2.3:a:openssh-sftp-server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp-server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-sftp-server","purl":"pkg:deb/ubuntu/openssh-sftp-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-sftp-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.list"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-48795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-48795","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-48795","date":"2026-10-07","epss":0.93547,"percentile":0.9984}],"risk":46.7735,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-48795"},"relatedVulnerabilities":[{"id":"CVE-2023-48795","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-48795","cwe":"CWE-354","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-48795","date":"2026-10-07","epss":0.93547,"percentile":0.9984}],"urls":["http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html","http://seclists.org/fulldisclosure/2024/Mar/21","http://www.openwall.com/lists/oss-security/2023/12/18/3","http://www.openwall.com/lists/oss-security/2023/12/19/5","http://www.openwall.com/lists/oss-security/2023/12/20/3","http://www.openwall.com/lists/oss-security/2024/03/06/3","http://www.openwall.com/lists/oss-security/2024/04/17/8","https://access.redhat.com/security/cve/cve-2023-48795","https://arstechnica.com/security/2023/12/hackers-can-break-ssh-channel-integrity-using-novel-data-corruption-attack/","https://bugs.gentoo.org/920280","https://bugzilla.redhat.com/show_bug.cgi?id=2254210","https://bugzilla.suse.com/show_bug.cgi?id=1217950","https://crates.io/crates/thrussh/versions","https://filezilla-project.org/versions.php","https://forum.netgate.com/topic/184941/terrapin-ssh-attack","https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.10&id=10e09e273f69e149389b3e0e5d44b8c221c2e7f6","https://github.com/NixOS/nixpkgs/pull/275249","https://github.com/PowerShell/Win32-OpenSSH/issues/2189","https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v9.5.0.0p1-Beta","https://github.com/TeraTermProject/teraterm/commit/7279fbd6ef4d0c8bdd6a90af4ada2899d786eec0","https://github.com/TeraTermProject/teraterm/releases/tag/v5.1","https://github.com/advisories/GHSA-45x7-px36-x8w8","https://github.com/apache/mina-sshd/issues/445","https://github.com/connectbot/sshlib/commit/5c8b534f6e97db7ac0e0e579331213aa25c173ab","https://github.com/connectbot/sshlib/compare/2.2.21...2.2.22","https://github.com/cyd01/KiTTY/issues/520","https://github.com/drakkan/sftpgo/releases/tag/v2.5.6","https://github.com/erlang/otp/blob/d1b43dc0f1361d2ad67601169e90a7fc50bb0369/lib/ssh/doc/src/notes.xml#L39-L42","https://github.com/erlang/otp/releases/tag/OTP-26.2.1","https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d","https://github.com/hierynomus/sshj/issues/916","https://github.com/janmojzis/tinyssh/issues/81","https://github.com/jtesta/ssh-audit/commit/8e972c5e94b460379fe0c7d20209c16df81538a5","https://github.com/libssh2/libssh2/pull/1291","https://github.com/mkj/dropbear/blob/17657c36cce6df7716d5ff151ec09a665382d5dd/CHANGES#L25","https://github.com/mscdex/ssh2/commit/97b223f8891b96d6fc054df5ab1d5a1a545da2a3","https://github.com/mwiede/jsch/compare/jsch-0.2.14...jsch-0.2.15","https://github.com/mwiede/jsch/issues/457","https://github.com/mwiede/jsch/pull/461","https://github.com/net-ssh/net-ssh/blob/2e65064a52d73396bfc3806c9196fc8108f33cd8/CHANGES.txt#L14-L16","https://github.com/openssh/openssh-portable/commits/master","https://github.com/paramiko/paramiko/issues/2337","https://github.com/proftpd/proftpd/blob/0a7ea9b0ba9fcdf368374a226370d08f10397d99/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/d21e7a2e47e9b38f709bec58e3fa711f759ad0e1/RELEASE_NOTES","https://github.com/proftpd/proftpd/blob/master/RELEASE_NOTES","https://github.com/proftpd/proftpd/issues/456","https://github.com/rapier1/hpn-ssh/releases","https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst","https://github.com/ronf/asyncssh/tags","https://github.com/ssh-mitm/ssh-mitm/issues/165","https://github.com/warp-tech/russh/releases/tag/v0.40.2","https://gitlab.com/libssh/libssh-mirror/-/tags","https://groups.google.com/g/golang-announce/c/-n5WqVC18LQ","https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg","https://help.panic.com/releasenotes/transmit5/","https://jadaptive.com/important-java-ssh-security-update-new-ssh-vulnerability-discovered-cve-2023-48795/","https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2024/01/msg00014.html","https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CAYYW35MUTNO65RVAELICTNZZFMT2XS/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BL5KTLOSLH2KHRN4HCXJPK3JUVLDGEL6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHITS4PUOZAKFIUBQAQZC7JWXMOYE4B/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F7EYCFQCTSGJXWO3ZZ44MGKFC5HA7G3Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEOTKBUPZXHE3F352JBYNTSNRXYLWD6P/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KMZCVGUGJZZVDPCVDA7TEB22VUCNEXDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QI3EHAHABFQK7OABNCSF5GMYP6TONTI7/","https://matt.ucc.asn.au/dropbear/CHANGES","https://nest.pijul.com/pijul/thrussh/changes/D6H7OWTTMHHX6BTB3B6MNBOBX2L66CBL4LGSEUSAI2MCRCJDQFRQC","https://news.ycombinator.com/item?id=38684904","https://news.ycombinator.com/item?id=38685286","https://news.ycombinator.com/item?id=38732005","https://nova.app/releases/#v11.8","https://oryx-embedded.com/download/#changelog","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0002","https://roumenpetrov.info/secsh/#news20231220","https://security-tracker.debian.org/tracker/CVE-2023-48795","https://security-tracker.debian.org/tracker/source-package/libssh2","https://security-tracker.debian.org/tracker/source-package/proftpd-dfsg","https://security-tracker.debian.org/tracker/source-package/trilead-ssh2","https://security.gentoo.org/glsa/202312-16","https://security.gentoo.org/glsa/202312-17","https://security.netapp.com/advisory/ntap-20240105-0004/","https://support.apple.com/kb/HT214084","https://thorntech.com/cve-2023-48795-and-sftp-gateway/","https://twitter.com/TrueSkrillor/status/1736774389725565005","https://ubuntu.com/security/CVE-2023-48795","https://winscp.net/eng/docs/history#6.2.2","https://www.bitvise.com/ssh-client-version-history#933","https://www.bitvise.com/ssh-server-version-history","https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html","https://www.crushftp.com/crush10wiki/Wiki.jsp?page=Update","https://www.debian.org/security/2023/dsa-5586","https://www.debian.org/security/2023/dsa-5588","https://www.freebsd.org/security/advisories/FreeBSD-SA-23:19.openssh.asc","https://www.lancom-systems.de/service-support/allgemeine-sicherheitshinweise#c243508","https://www.netsarang.com/en/xshell-update-history/","https://www.openssh.com/openbsd.html","https://www.openssh.com/txt/release-9.6","https://www.openwall.com/lists/oss-security/2023/12/18/2","https://www.openwall.com/lists/oss-security/2023/12/20/3","https://www.paramiko.org/changelog.html","https://www.reddit.com/r/sysadmin/comments/18idv52/cve202348795_why_is_this_cve_still_undisclosed/","https://www.suse.com/c/suse-addresses-the-ssh-v2-protocol-terrapin-attack-aka-cve-2023-48795/","https://www.terrapin-attack.com","https://www.theregister.com/2023/12/20/terrapin_attack_ssh","https://www.vandyke.com/products/securecrt/history.txt","https://lists.debian.org/debian-lts-announce/2024/09/msg00042.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/33XHJUB6ROFUOH2OQNENFROTVH6MHSHA/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JIMLVBDWOP4FUPXPTB4PGHHIOMGFLQE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3YQLUQWLIHDB5QCXQEX7HXHAWMOKPP5O/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6Y74KVCPEPT4MVU3LHDWCNNOXOE5ZLUR/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APYIXIQOVDCRWLHTGB4VYMAUIAQLKYJ3/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C3AFMZ6MH2UHHOPIWT5YLSFV3D2VB3AC/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYEDEXIKFKTUJIN43RG4B7T5ZS6MHUSP/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I724O3LSRCPO4WNVIXTZCT4VVRMXMMSG/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L5Y6MNNVAPIJSXJERQ6PKZVCIUXSNJK7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/","https://www.vicarius.io/vsociety/posts/cve-2023-48795-detect-openssh-vulnerabilit","https://www.vicarius.io/vsociety/posts/cve-2023-48795-mitigate-openssh-vulnerability","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-48795","description":"The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-0286","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-0286","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-07","epss":0.59501,"percentile":0.99104}],"risk":44.625750000000004,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-0286"},"relatedVulnerabilities":[{"id":"CVE-2023-0286","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-07","epss":0.59501,"percentile":0.99104}],"urls":["https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-0286","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-0286","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-07","epss":0.59501,"percentile":0.99104}],"risk":44.625750000000004,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-0286"},"relatedVulnerabilities":[{"id":"CVE-2023-0286","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-0286","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-0286","date":"2026-10-07","epss":0.59501,"percentile":0.99104}],"urls":["https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.6.2-relnotes.txt","https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/018_x509.patch.sig","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c6c9d439b484e1ba9830d8454a34fa4f80fdfe9","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2f7530077e0ef79d98718138716bc51ca0cad658","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fd2af07dc083a350c959147097003a14a5e8ac4d","https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-0286","description":"There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35590","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"risk":44.2485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35590"},"relatedVulnerabilities":[{"id":"CVE-2021-35590","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:C/I:C/A:C","metrics":{"baseScore":6.5,"impactScore":10.1,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1226/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35590","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35590","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"risk":44.2485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35590"},"relatedVulnerabilities":[{"id":"CVE-2021-35590","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:C/I:C/A:C","metrics":{"baseScore":6.5,"impactScore":10.1,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1226/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35590","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35590","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"risk":44.2485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35590"},"relatedVulnerabilities":[{"id":"CVE-2021-35590","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:C/I:C/A:C","metrics":{"baseScore":6.5,"impactScore":10.1,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1226/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35590","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35590","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"risk":44.2485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35590"},"relatedVulnerabilities":[{"id":"CVE-2021-35590","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:C/I:C/A:C","metrics":{"baseScore":6.5,"impactScore":10.1,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1226/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35590","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35590","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"risk":44.2485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35590"},"relatedVulnerabilities":[{"id":"CVE-2021-35590","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:C/I:C/A:C","metrics":{"baseScore":6.5,"impactScore":10.1,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1226/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35590","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35590","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"risk":44.2485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35590"},"relatedVulnerabilities":[{"id":"CVE-2021-35590","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:C/I:C/A:C","metrics":{"baseScore":6.5,"impactScore":10.1,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1226/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35590","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35590","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35590","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"risk":44.2485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35590"},"relatedVulnerabilities":[{"id":"CVE-2021-35590","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:C/I:C/A:C","metrics":{"baseScore":6.5,"impactScore":10.1,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35590","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35590","date":"2026-10-07","epss":0.88497,"percentile":0.99771}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1226/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35590","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0cce56105b872ee0","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.19-0ubuntu6.9?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.9","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.9"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-07","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-07","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"2a99d1b0f32aebfa","cpes":["cpe:2.3:a:libc6:libc6:2.19-0ubuntu6.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.19-0ubuntu6.9?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.9","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.9"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-07","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-07","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"63846d3755a29a0c","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-0ubuntu6.9:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/ubuntu/multiarch-support@2.19-0ubuntu6.9?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.9","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2961","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.9"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-2961","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-07","epss":0.8833,"percentile":0.99769}],"risk":44.165,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2961"},"relatedVulnerabilities":[{"id":"CVE-2024-2961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7.3,"impactScore":4.8,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2961","cwe":"CWE-787","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2024-2961","date":"2026-10-07","epss":0.8833,"percentile":0.99769}],"urls":["http://www.openwall.com/lists/oss-security/2024/04/17/9","http://www.openwall.com/lists/oss-security/2024/04/18/4","http://www.openwall.com/lists/oss-security/2024/04/24/2","http://www.openwall.com/lists/oss-security/2024/05/27/1","http://www.openwall.com/lists/oss-security/2024/05/27/2","http://www.openwall.com/lists/oss-security/2024/05/27/3","http://www.openwall.com/lists/oss-security/2024/05/27/4","http://www.openwall.com/lists/oss-security/2024/05/27/5","http://www.openwall.com/lists/oss-security/2024/05/27/6","http://www.openwall.com/lists/oss-security/2024/07/22/5","https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/","https://security.netapp.com/advisory/ntap-20240531-0002/","https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004","https://www.ambionics.io/blog/iconv-cve-2024-2961-p1","https://www.ambionics.io/blog/iconv-cve-2024-2961-p2","https://www.ambionics.io/blog/iconv-cve-2024-2961-p3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2961","description":"The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable."}]},{"artifact":{"id":"f93e78451600da86","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.2?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.2","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-36221","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-36221","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36221","date":"2026-10-07","epss":0.84994,"percentile":0.99709}],"risk":42.497,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-36221"},"relatedVulnerabilities":[{"id":"CVE-2020-36221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36221","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36221","date":"2026-10-07","epss":0.84994,"percentile":0.99709}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9404","https://bugs.openldap.org/show_bug.cgi?id=9424","https://git.openldap.org/openldap/openldap/-/commit/38ac838e4150c626bbfa0082b7e2cf3a2bb4df31","https://git.openldap.org/openldap/openldap/-/commit/58c1748e81c843c5b6e61648d2a4d1d82b47e842","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36221","description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck)."}]},{"artifact":{"id":"f93e78451600da86","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.2?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.2","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36228","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-36228","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-36228","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36228","date":"2026-10-07","epss":0.84994,"percentile":0.99709}],"risk":42.497,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-36228"},"relatedVulnerabilities":[{"id":"CVE-2020-36228","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36228","cwe":"CWE-191","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36228","date":"2026-10-07","epss":0.84994,"percentile":0.99709}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9427","https://git.openldap.org/openldap/openldap/-/commit/91dccd25c347733b365adc74cb07d074512ed5ad","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36228","description":"An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-1292","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-1292","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-1292","date":"2026-10-07","epss":0.82612,"percentile":0.99661}],"risk":41.306,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-1292"},"relatedVulnerabilities":[{"id":"CVE-2022-1292","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-1292","date":"2026-10-07","epss":0.82612,"percentile":0.99661}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=548d3f280a6e737673f5b61fce24bb100108dfeb","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23","https://lists.debian.org/debian-lts-announce/2022/05/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VX4KWHPMKYJL6ZLW4M5IU7E5UV5ZWJQU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNU5M7BXMML26G3GPYKFGQYPQDRSNKDD/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0011","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220602-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://www.debian.org/security/2022/dsa-5139","https://www.openssl.org/news/secadv/20220503.txt","https://www.oracle.com/security-alerts/cpujul2022.html","https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1292","description":"The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd)."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-1292","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-1292","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-1292","date":"2026-10-07","epss":0.82612,"percentile":0.99661}],"risk":41.306,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-1292"},"relatedVulnerabilities":[{"id":"CVE-2022-1292","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.3,"impactScore":5.9,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-1292","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-1292","date":"2026-10-07","epss":0.82612,"percentile":0.99661}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=548d3f280a6e737673f5b61fce24bb100108dfeb","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23","https://lists.debian.org/debian-lts-announce/2022/05/msg00019.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VX4KWHPMKYJL6ZLW4M5IU7E5UV5ZWJQU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNU5M7BXMML26G3GPYKFGQYPQDRSNKDD/","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0011","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20220602-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://www.debian.org/security/2022/dsa-5139","https://www.openssl.org/news/secadv/20220503.txt","https://www.oracle.com/security-alerts/cpujul2022.html","https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-1292","description":"The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd)."}]},{"artifact":{"id":"3695a31b2933dc8f","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-38408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-38408","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-38408","date":"2026-10-07","epss":0.797,"percentile":0.99601}],"risk":39.85,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-38408"},"relatedVulnerabilities":[{"id":"CVE-2023-38408","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-38408","date":"2026-10-07","epss":0.797,"percentile":0.99601}],"urls":["http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2023/07/20/1","http://www.openwall.com/lists/oss-security/2023/07/20/2","http://www.openwall.com/lists/oss-security/2023/09/22/11","http://www.openwall.com/lists/oss-security/2023/09/22/9","https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent","https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8","https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d","https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca","https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/","https://news.ycombinator.com/item?id=36790196","https://security.gentoo.org/glsa/202307-01","https://security.netapp.com/advisory/ntap-20230803-0010/","https://support.apple.com/kb/HT213940","https://www.openssh.com/security.html","https://www.openssh.com/txt/release-9.3p2","https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt","https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-38408","description":"The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009."}]},{"artifact":{"id":"54d7c6e40533c708","cpes":["cpe:2.3:a:openssh-server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-server","purl":"pkg:deb/ubuntu/openssh-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.config","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.config"},{"path":"/var/lib/dpkg/info/openssh-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.list"},{"path":"/var/lib/dpkg/info/openssh-server.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postinst"},{"path":"/var/lib/dpkg/info/openssh-server.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postrm"},{"path":"/var/lib/dpkg/info/openssh-server.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.preinst"},{"path":"/var/lib/dpkg/info/openssh-server.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.prerm"},{"path":"/var/lib/dpkg/info/openssh-server.templates","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.templates"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-38408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-38408","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-38408","date":"2026-10-07","epss":0.797,"percentile":0.99601}],"risk":39.85,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-38408"},"relatedVulnerabilities":[{"id":"CVE-2023-38408","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-38408","date":"2026-10-07","epss":0.797,"percentile":0.99601}],"urls":["http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2023/07/20/1","http://www.openwall.com/lists/oss-security/2023/07/20/2","http://www.openwall.com/lists/oss-security/2023/09/22/11","http://www.openwall.com/lists/oss-security/2023/09/22/9","https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent","https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8","https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d","https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca","https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/","https://news.ycombinator.com/item?id=36790196","https://security.gentoo.org/glsa/202307-01","https://security.netapp.com/advisory/ntap-20230803-0010/","https://support.apple.com/kb/HT213940","https://www.openssh.com/security.html","https://www.openssh.com/txt/release-9.3p2","https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt","https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-38408","description":"The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009."}]},{"artifact":{"id":"b3db4be88de03e2f","cpes":["cpe:2.3:a:openssh-sftp-server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp-server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-sftp-server","purl":"pkg:deb/ubuntu/openssh-sftp-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-sftp-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.list"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-38408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-38408","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-38408","date":"2026-10-07","epss":0.797,"percentile":0.99601}],"risk":39.85,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-38408"},"relatedVulnerabilities":[{"id":"CVE-2023-38408","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-38408","cwe":"CWE-428","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-38408","date":"2026-10-07","epss":0.797,"percentile":0.99601}],"urls":["http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2023/07/20/1","http://www.openwall.com/lists/oss-security/2023/07/20/2","http://www.openwall.com/lists/oss-security/2023/09/22/11","http://www.openwall.com/lists/oss-security/2023/09/22/9","https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent","https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8","https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d","https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca","https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/","https://news.ycombinator.com/item?id=36790196","https://security.gentoo.org/glsa/202307-01","https://security.netapp.com/advisory/ntap-20230803-0010/","https://support.apple.com/kb/HT213940","https://www.openssh.com/security.html","https://www.openssh.com/txt/release-9.3p2","https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt","https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-38408","description":"The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21489","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"risk":39.427,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21489"},"relatedVulnerabilities":[{"id":"CVE-2022-21489","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21489","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21489","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"risk":39.427,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21489"},"relatedVulnerabilities":[{"id":"CVE-2022-21489","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21489","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21489","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"risk":39.427,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21489"},"relatedVulnerabilities":[{"id":"CVE-2022-21489","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21489","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21489","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"risk":39.427,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21489"},"relatedVulnerabilities":[{"id":"CVE-2022-21489","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21489","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21489","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"risk":39.427,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21489"},"relatedVulnerabilities":[{"id":"CVE-2022-21489","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21489","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21489","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"risk":39.427,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21489"},"relatedVulnerabilities":[{"id":"CVE-2022-21489","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21489","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21489","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"risk":39.427,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21489"},"relatedVulnerabilities":[{"id":"CVE-2022-21489","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21489","date":"2026-10-07","epss":0.78854,"percentile":0.99586}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21489","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21490","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21490","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"risk":39.333,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21490"},"relatedVulnerabilities":[{"id":"CVE-2022-21490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21490","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21490","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21490","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"risk":39.333,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21490"},"relatedVulnerabilities":[{"id":"CVE-2022-21490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21490","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21490","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21490","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"risk":39.333,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21490"},"relatedVulnerabilities":[{"id":"CVE-2022-21490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21490","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21490","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21490","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"risk":39.333,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21490"},"relatedVulnerabilities":[{"id":"CVE-2022-21490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21490","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21490","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21490","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"risk":39.333,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21490"},"relatedVulnerabilities":[{"id":"CVE-2022-21490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21490","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21490","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21490","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"risk":39.333,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21490"},"relatedVulnerabilities":[{"id":"CVE-2022-21490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21490","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-21490","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-21490","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"risk":39.333,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-21490"},"relatedVulnerabilities":[{"id":"CVE-2022-21490","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-21490","date":"2026-10-07","epss":0.78666,"percentile":0.9958}],"urls":["https://security.netapp.com/advisory/ntap-20220429-0005/","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-21490","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.35 and prior, 7.5.25 and prior, 7.6.21 and prior and 8.0.28 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"f93e78451600da86","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.2?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.2","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36222","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-36222","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-36222","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36222","date":"2026-10-07","epss":0.77236,"percentile":0.99545}],"risk":38.618,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-36222"},"relatedVulnerabilities":[{"id":"CVE-2020-36222","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36222","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36222","date":"2026-10-07","epss":0.77236,"percentile":0.99545}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9406","https://bugs.openldap.org/show_bug.cgi?id=9407","https://git.openldap.org/openldap/openldap/-/commit/02dfc32d658fadc25e4040f78e36592f6e1e1ca0","https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed","https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed.aa","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36222","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service."}]},{"artifact":{"id":"f93e78451600da86","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.2?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.2","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36227","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-36227","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-36227","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36227","date":"2026-10-07","epss":0.77236,"percentile":0.99545}],"risk":38.618,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-36227"},"relatedVulnerabilities":[{"id":"CVE-2020-36227","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36227","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36227","date":"2026-10-07","epss":0.77236,"percentile":0.99545}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9428","https://git.openldap.org/openldap/openldap/-/commit/9d0e8485f3113505743baabf1167e01e4558ccf5","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36227","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-2650","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-2650","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-10-07","epss":0.75116,"percentile":0.995}],"risk":37.558,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-2650"},"relatedVulnerabilities":[{"id":"CVE-2023-2650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-10-07","epss":0.75116,"percentile":0.995}],"urls":["http://www.openwall.com/lists/oss-security/2023/05/30/1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230703-0001/","https://security.netapp.com/advisory/ntap-20231027-0009/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230530.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime.  The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced.  This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL.  If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS.  It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain.  Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates.  This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-2650","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-2650","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-10-07","epss":0.75116,"percentile":0.995}],"risk":37.558,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-2650"},"relatedVulnerabilities":[{"id":"CVE-2023-2650","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-2650","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-2650","date":"2026-10-07","epss":0.75116,"percentile":0.995}],"urls":["http://www.openwall.com/lists/oss-security/2023/05/30/1","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098","https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a","https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009","https://security.gentoo.org/glsa/202402-08","https://security.netapp.com/advisory/ntap-20230703-0001/","https://security.netapp.com/advisory/ntap-20231027-0009/","https://www.debian.org/security/2023/dsa-5417","https://www.openssl.org/news/secadv/20230530.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-2650","description":"Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit.  OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime.  The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced.  This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL.  If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS.  It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain.  Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates.  This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low."}]},{"artifact":{"id":"9f127744e4033e99","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.8.2-1ubuntu2.1?arch=amd64&distro=ubuntu-14.04&upstream=sqlite3","type":"deb","version":"3.8.2-1ubuntu2.1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6965","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sqlite3","version":"3.8.2-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2025-6965","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6965","cwe":"CWE-197","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-6965","date":"2026-10-07","epss":0.71394,"percentile":0.99401}],"risk":35.697,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6965"},"relatedVulnerabilities":[{"id":"CVE-2025-6965","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L","metrics":{"baseScore":7.7,"impactScore":5.3,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve-coordination@google.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Green","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6965","cwe":"CWE-197","type":"Secondary","source":"cve-coordination@google.com"}],"epss":[{"cve":"CVE-2025-6965","date":"2026-10-07","epss":0.71394,"percentile":0.99401}],"urls":["https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8","http://seclists.org/fulldisclosure/2025/Sep/49","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/56","http://seclists.org/fulldisclosure/2025/Sep/57","http://seclists.org/fulldisclosure/2025/Sep/58","http://www.openwall.com/lists/oss-security/2025/09/06/1","https://cert-portal.siemens.com/productcert/html/ssa-225816.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6965","description":"There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above."}]},{"artifact":{"id":"f93e78451600da86","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.2?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.2","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-29155","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-29155","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-29155","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29155","date":"2026-10-07","epss":0.64487,"percentile":0.9922}],"risk":32.243500000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-29155"},"relatedVulnerabilities":[{"id":"CVE-2022-29155","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-29155","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-29155","date":"2026-10-07","epss":0.64487,"percentile":0.9922}],"urls":["https://bugs.openldap.org/show_bug.cgi?id=9815","https://lists.debian.org/debian-lts-announce/2022/05/msg00032.html","https://security.netapp.com/advisory/ntap-20220609-0007/","https://www.debian.org/security/2022/dsa-5140"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-29155","description":"In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of proper escaping."}]},{"artifact":{"id":"f93e78451600da86","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.2?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.2","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-27212","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-27212","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-27212","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27212","date":"2026-10-07","epss":0.64147,"percentile":0.99212}],"risk":32.073499999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-27212"},"relatedVulnerabilities":[{"id":"CVE-2021-27212","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-27212","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-27212","date":"2026-10-07","epss":0.64147,"percentile":0.99212}],"urls":["https://bugs.openldap.org/show_bug.cgi?id=9454","https://git.openldap.org/openldap/openldap/-/commit/3539fc33212b528c56b716584f2c2994af7c30b0","https://git.openldap.org/openldap/openldap/-/commit/9badb73425a67768c09bcaed1a9c26c684af6c30","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00035.html","https://security.netapp.com/advisory/ntap-20210319-0005/","https://www.debian.org/security/2021/dsa-4860"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-27212","description":"In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime."}]},{"artifact":{"id":"328fe217962e5779","cpes":["cpe:2.3:a:sudo:sudo:1.8.9p5-1ubuntu1.2:*:*:*:*:*:*:*"],"name":"sudo","purl":"pkg:deb/ubuntu/sudo@1.8.9p5-1ubuntu1.2?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.8.9p5-1ubuntu1.2","language":"","licenses":["BSD-3-Clause","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/sudo/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/sudo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.list"},{"path":"/var/lib/dpkg/info/sudo.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.postinst"},{"path":"/var/lib/dpkg/info/sudo.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.postrm"},{"path":"/var/lib/dpkg/info/sudo.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.preinst"},{"path":"/var/lib/dpkg/info/sudo.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-14287","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sudo","version":"1.8.9p5-1ubuntu1.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-14287","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-14287","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14287","date":"2026-10-07","epss":0.63764,"percentile":0.99203}],"risk":31.881999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-14287"},"relatedVulnerabilities":[{"id":"CVE-2019-14287","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","metrics":{"baseScore":9,"impactScore":10.1,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-14287","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-14287","date":"2026-10-07","epss":0.63764,"percentile":0.99203}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00047.html","http://packetstormsecurity.com/files/154853/Slackware-Security-Advisory-sudo-Updates.html","http://www.openwall.com/lists/oss-security/2019/10/14/1","http://www.openwall.com/lists/oss-security/2019/10/24/1","http://www.openwall.com/lists/oss-security/2019/10/29/3","http://www.openwall.com/lists/oss-security/2021/09/14/2","https://access.redhat.com/errata/RHBA-2019:3248","https://access.redhat.com/errata/RHSA-2019:3197","https://access.redhat.com/errata/RHSA-2019:3204","https://access.redhat.com/errata/RHSA-2019:3205","https://access.redhat.com/errata/RHSA-2019:3209","https://access.redhat.com/errata/RHSA-2019:3219","https://access.redhat.com/errata/RHSA-2019:3278","https://access.redhat.com/errata/RHSA-2019:3694","https://access.redhat.com/errata/RHSA-2019:3754","https://access.redhat.com/errata/RHSA-2019:3755","https://access.redhat.com/errata/RHSA-2019:3895","https://access.redhat.com/errata/RHSA-2019:3916","https://access.redhat.com/errata/RHSA-2019:3941","https://access.redhat.com/errata/RHSA-2019:4191","https://access.redhat.com/errata/RHSA-2020:0388","https://lists.debian.org/debian-lts-announce/2019/10/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IP7SIOAVLSKJGMTIULX52VQUPTVSC43U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NPLAM57TPJQGKQMNG6RHFBLACD6K356N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TUVAOZBYUHZS56A5FQSCDVGXT7PW7FL2/","https://resources.whitesourcesoftware.com/blog-whitesource/new-vulnerability-in-sudo-cve-2019-14287","https://seclists.org/bugtraq/2019/Oct/20","https://seclists.org/bugtraq/2019/Oct/21","https://security.gentoo.org/glsa/202003-12","https://security.netapp.com/advisory/ntap-20191017-0003/","https://support.f5.com/csp/article/K53746212?utm_source=f5support&amp%3Butm_medium=RSS","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03976en_us","https://usn.ubuntu.com/4154-1/","https://www.debian.org/security/2019/dsa-4543","https://www.openwall.com/lists/oss-security/2019/10/15/2","https://www.sudo.ws/alerts/minus_1_uid.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-14287","description":"In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a \"sudo -u \\#$((0xffffffff))\" command."}]},{"artifact":{"id":"3695a31b2933dc8f","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15473","versionConstraint":"< 1:6.6p1-2ubuntu2.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-15473","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.11"],"available":[{"date":"2018-11-06","kind":"advisory","version":"1:6.6p1-2ubuntu2.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15473","date":"2026-10-07","epss":0.98631,"percentile":0.99923}],"risk":29.5893,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-15473"},"relatedVulnerabilities":[{"id":"CVE-2018-15473","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15473","date":"2026-10-07","epss":0.98631,"percentile":0.99923}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/15/5","http://www.securityfocus.com/bid/105140","http://www.securitytracker.com/id/1041487","https://access.redhat.com/errata/RHSA-2019:0711","https://access.redhat.com/errata/RHSA-2019:2143","https://bugs.debian.org/906236","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0","https://lists.debian.org/debian-lts-announce/2018/08/msg00022.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011","https://security.gentoo.org/glsa/201810-03","https://security.netapp.com/advisory/ntap-20181101-0001/","https://usn.ubuntu.com/3809-1/","https://www.debian.org/security/2018/dsa-4280","https://www.exploit-db.com/exploits/45210/","https://www.exploit-db.com/exploits/45233/","https://www.exploit-db.com/exploits/45939/","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15473","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c."}]},{"artifact":{"id":"54d7c6e40533c708","cpes":["cpe:2.3:a:openssh-server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-server","purl":"pkg:deb/ubuntu/openssh-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.config","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.config"},{"path":"/var/lib/dpkg/info/openssh-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.list"},{"path":"/var/lib/dpkg/info/openssh-server.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postinst"},{"path":"/var/lib/dpkg/info/openssh-server.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postrm"},{"path":"/var/lib/dpkg/info/openssh-server.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.preinst"},{"path":"/var/lib/dpkg/info/openssh-server.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.prerm"},{"path":"/var/lib/dpkg/info/openssh-server.templates","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.templates"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15473","versionConstraint":"< 1:6.6p1-2ubuntu2.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-15473","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.11"],"available":[{"date":"2018-11-06","kind":"advisory","version":"1:6.6p1-2ubuntu2.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15473","date":"2026-10-07","epss":0.98631,"percentile":0.99923}],"risk":29.5893,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-15473"},"relatedVulnerabilities":[{"id":"CVE-2018-15473","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15473","date":"2026-10-07","epss":0.98631,"percentile":0.99923}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/15/5","http://www.securityfocus.com/bid/105140","http://www.securitytracker.com/id/1041487","https://access.redhat.com/errata/RHSA-2019:0711","https://access.redhat.com/errata/RHSA-2019:2143","https://bugs.debian.org/906236","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0","https://lists.debian.org/debian-lts-announce/2018/08/msg00022.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011","https://security.gentoo.org/glsa/201810-03","https://security.netapp.com/advisory/ntap-20181101-0001/","https://usn.ubuntu.com/3809-1/","https://www.debian.org/security/2018/dsa-4280","https://www.exploit-db.com/exploits/45210/","https://www.exploit-db.com/exploits/45233/","https://www.exploit-db.com/exploits/45939/","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15473","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c."}]},{"artifact":{"id":"b3db4be88de03e2f","cpes":["cpe:2.3:a:openssh-sftp-server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp-server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-sftp-server","purl":"pkg:deb/ubuntu/openssh-sftp-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-sftp-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.list"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-15473","versionConstraint":"< 1:6.6p1-2ubuntu2.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-15473","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.11"],"available":[{"date":"2018-11-06","kind":"advisory","version":"1:6.6p1-2ubuntu2.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15473","date":"2026-10-07","epss":0.98631,"percentile":0.99923}],"risk":29.5893,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-15473"},"relatedVulnerabilities":[{"id":"CVE-2018-15473","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-15473","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-15473","date":"2026-10-07","epss":0.98631,"percentile":0.99923}],"urls":["http://www.openwall.com/lists/oss-security/2018/08/15/5","http://www.securityfocus.com/bid/105140","http://www.securitytracker.com/id/1041487","https://access.redhat.com/errata/RHSA-2019:0711","https://access.redhat.com/errata/RHSA-2019:2143","https://bugs.debian.org/906236","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0","https://lists.debian.org/debian-lts-announce/2018/08/msg00022.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0011","https://security.gentoo.org/glsa/201810-03","https://security.netapp.com/advisory/ntap-20181101-0001/","https://usn.ubuntu.com/3809-1/","https://www.debian.org/security/2018/dsa-4280","https://www.exploit-db.com/exploits/45210/","https://www.exploit-db.com/exploits/45233/","https://www.exploit-db.com/exploits/45939/","https://www.oracle.com/security-alerts/cpujan2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-15473","description":"OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c."}]},{"artifact":{"id":"3695a31b2933dc8f","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6515","versionConstraint":"< 1:6.6p1-2ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6515","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.8"],"available":[{"date":"2016-08-15","kind":"advisory","version":"1:6.6p1-2ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6515","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6515","date":"2026-10-07","epss":0.58568,"percentile":0.99081}],"risk":29.284,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6515"},"relatedVulnerabilities":[{"id":"CVE-2016-6515","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6515","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6515","date":"2026-10-07","epss":0.58568,"percentile":0.99081}],"urls":["http://openwall.com/lists/oss-security/2016/08/01/2","http://packetstormsecurity.com/files/140070/OpenSSH-7.2-Denial-Of-Service.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/92212","http://www.securitytracker.com/id/1036487","https://access.redhat.com/errata/RHSA-2017:2029","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf","https://github.com/openssh/openssh-portable/commit/fcd135c9df440bcd2d5870405ad3311743d78d97","https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2L6RW34VFNXYNVVN2CN73YAGJ5VMTFU/","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:06.openssh.asc","https://security.netapp.com/advisory/ntap-20171130-0003/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03779en_us","https://www.exploit-db.com/exploits/40888/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6515","description":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string."}]},{"artifact":{"id":"54d7c6e40533c708","cpes":["cpe:2.3:a:openssh-server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-server","purl":"pkg:deb/ubuntu/openssh-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.config","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.config"},{"path":"/var/lib/dpkg/info/openssh-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.list"},{"path":"/var/lib/dpkg/info/openssh-server.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postinst"},{"path":"/var/lib/dpkg/info/openssh-server.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postrm"},{"path":"/var/lib/dpkg/info/openssh-server.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.preinst"},{"path":"/var/lib/dpkg/info/openssh-server.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.prerm"},{"path":"/var/lib/dpkg/info/openssh-server.templates","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.templates"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6515","versionConstraint":"< 1:6.6p1-2ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6515","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.8"],"available":[{"date":"2016-08-15","kind":"advisory","version":"1:6.6p1-2ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6515","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6515","date":"2026-10-07","epss":0.58568,"percentile":0.99081}],"risk":29.284,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6515"},"relatedVulnerabilities":[{"id":"CVE-2016-6515","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6515","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6515","date":"2026-10-07","epss":0.58568,"percentile":0.99081}],"urls":["http://openwall.com/lists/oss-security/2016/08/01/2","http://packetstormsecurity.com/files/140070/OpenSSH-7.2-Denial-Of-Service.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/92212","http://www.securitytracker.com/id/1036487","https://access.redhat.com/errata/RHSA-2017:2029","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf","https://github.com/openssh/openssh-portable/commit/fcd135c9df440bcd2d5870405ad3311743d78d97","https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2L6RW34VFNXYNVVN2CN73YAGJ5VMTFU/","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:06.openssh.asc","https://security.netapp.com/advisory/ntap-20171130-0003/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03779en_us","https://www.exploit-db.com/exploits/40888/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6515","description":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string."}]},{"artifact":{"id":"b3db4be88de03e2f","cpes":["cpe:2.3:a:openssh-sftp-server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp-server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-sftp-server","purl":"pkg:deb/ubuntu/openssh-sftp-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-sftp-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.list"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6515","versionConstraint":"< 1:6.6p1-2ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6515","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.8"],"available":[{"date":"2016-08-15","kind":"advisory","version":"1:6.6p1-2ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6515","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6515","date":"2026-10-07","epss":0.58568,"percentile":0.99081}],"risk":29.284,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6515"},"relatedVulnerabilities":[{"id":"CVE-2016-6515","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"impactScore":6.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6515","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6515","date":"2026-10-07","epss":0.58568,"percentile":0.99081}],"urls":["http://openwall.com/lists/oss-security/2016/08/01/2","http://packetstormsecurity.com/files/140070/OpenSSH-7.2-Denial-Of-Service.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/92212","http://www.securitytracker.com/id/1036487","https://access.redhat.com/errata/RHSA-2017:2029","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf","https://github.com/openssh/openssh-portable/commit/fcd135c9df440bcd2d5870405ad3311743d78d97","https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2L6RW34VFNXYNVVN2CN73YAGJ5VMTFU/","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:06.openssh.asc","https://security.netapp.com/advisory/ntap-20171130-0003/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03779en_us","https://www.exploit-db.com/exploits/40888/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6515","description":"The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.22"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3731","versionConstraint":"< 1.0.1f-1ubuntu2.22 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-3731","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.22"],"available":[{"date":"2017-01-31","kind":"advisory","version":"1.0.1f-1ubuntu2.22"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3731","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3731","date":"2026-10-07","epss":0.57322,"percentile":0.99056}],"risk":28.660999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-3731"},"relatedVulnerabilities":[{"id":"CVE-2017-3731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3731","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3731","date":"2026-10-07","epss":0.57322,"percentile":0.99056}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0286.html","http://www.debian.org/security/2017/dsa-3773","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/95813","http://www.securitytracker.com/id/1037717","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc","https://security.gentoo.org/glsa/201702-07","https://security.netapp.com/advisory/ntap-20171019-0002/","https://security.paloaltonetworks.com/CVE-2017-3731","https://source.android.com/security/bulletin/pixel/2017-11-01","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us","https://www.openssl.org/news/secadv/20170126.txt","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.tenable.com/security/tns-2017-04"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3731","description":"If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.22"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-3731","versionConstraint":"< 1.0.1f-1ubuntu2.22 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-3731","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.22"],"available":[{"date":"2017-01-31","kind":"advisory","version":"1.0.1f-1ubuntu2.22"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3731","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3731","date":"2026-10-07","epss":0.57322,"percentile":0.99056}],"risk":28.660999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-3731"},"relatedVulnerabilities":[{"id":"CVE-2017-3731","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3731","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3731","date":"2026-10-07","epss":0.57322,"percentile":0.99056}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0286.html","http://www.debian.org/security/2017/dsa-3773","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/95813","http://www.securitytracker.com/id/1037717","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc","https://security.gentoo.org/glsa/201702-07","https://security.netapp.com/advisory/ntap-20171019-0002/","https://security.paloaltonetworks.com/CVE-2017-3731","https://source.android.com/security/bulletin/pixel/2017-11-01","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us","https://www.openssl.org/news/secadv/20170126.txt","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.tenable.com/security/tns-2017-04"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3731","description":"If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2183","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2183","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2183","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2183","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2183","date":"2026-10-07","epss":0.94697,"percentile":0.99857}],"risk":28.4091,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2183"},"relatedVulnerabilities":[{"id":"CVE-2016-2183","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2183","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2183","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2183","date":"2026-10-07","epss":0.94697,"percentile":0.99857}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00068.html","http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00028.html","http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://packetstormsecurity.com/files/142756/IBM-Informix-Dynamic-Server-DLL-Injection-Code-Execution.html","http://rhn.redhat.com/errata/RHSA-2017-0336.html","http://rhn.redhat.com/errata/RHSA-2017-0337.html","http://rhn.redhat.com/errata/RHSA-2017-0338.html","http://rhn.redhat.com/errata/RHSA-2017-0462.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://seclists.org/fulldisclosure/2017/May/105","http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697","http://www-01.ibm.com/support/docview.wss?uid=swg21991482","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/archive/1/539885/100/0/threaded","http://www.securityfocus.com/archive/1/540341/100/0/threaded","http://www.securityfocus.com/archive/1/541104/100/0/threaded","http://www.securityfocus.com/archive/1/542005/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/539885/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/540129/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/540341/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/541104/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/542005/100/0/threaded","http://www.securityfocus.com/bid/92630","http://www.securityfocus.com/bid/95568","http://www.securitytracker.com/id/1036696","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","http://www.ubuntu.com/usn/USN-3179-1","http://www.ubuntu.com/usn/USN-3194-1","http://www.ubuntu.com/usn/USN-3198-1","http://www.ubuntu.com/usn/USN-3270-1","http://www.ubuntu.com/usn/USN-3372-1","https://access.redhat.com/articles/2548661","https://access.redhat.com/errata/RHSA-2017:1216","https://access.redhat.com/errata/RHSA-2017:2708","https://access.redhat.com/errata/RHSA-2017:2709","https://access.redhat.com/errata/RHSA-2017:2710","https://access.redhat.com/errata/RHSA-2017:3113","https://access.redhat.com/errata/RHSA-2017:3114","https://access.redhat.com/errata/RHSA-2017:3239","https://access.redhat.com/errata/RHSA-2017:3240","https://access.redhat.com/errata/RHSA-2018:2123","https://access.redhat.com/errata/RHSA-2019:1245","https://access.redhat.com/errata/RHSA-2019:2859","https://access.redhat.com/errata/RHSA-2020:0451","https://access.redhat.com/security/cve/cve-2016-2183","https://blog.cryptographyengineering.com/2016/08/24/attack-of-week-64-bit-ciphers-in-tls/","https://bto.bluecoat.com/security-advisory/sa133","https://bugzilla.redhat.com/show_bug.cgi?id=1369383","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/ssllabs/ssllabs-scan/issues/387#issuecomment-242514633","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05369403","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05369415","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05385680","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05390722","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05390849","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03765en_us","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05309984","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05323116","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05349499","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369415","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390849","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://kc.mcafee.com/corporate/index?page=content&id=SB10186","https://kc.mcafee.com/corporate/index?page=content&id=SB10197","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://kc.mcafee.com/corporate/index?page=content&id=SB10310","https://nakedsecurity.sophos.com/2016/08/25/anatomy-of-a-cryptographic-collision-the-sweet32-attack/","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://seclists.org/bugtraq/2018/Nov/21","https://security.gentoo.org/glsa/201612-16","https://security.gentoo.org/glsa/201701-65","https://security.gentoo.org/glsa/201707-01","https://security.netapp.com/advisory/ntap-20160915-0001/","https://security.netapp.com/advisory/ntap-20170119-0001/","https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03158613","https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286178","https://support.f5.com/csp/article/K13167034","https://sweet32.info/","https://wiki.opendaylight.org/view/Security_Advisories","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.exploit-db.com/exploits/42091/","https://www.ietf.org/mail-archive/web/tls/current/msg04560.html","https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008","https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/august/new-practical-attacks-on-64-bit-block-ciphers-3des-blowfish/","https://www.openssl.org/blog/blog/2016/08/24/sweet32/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.sigsac.org/ccs/CCS2016/accepted-papers/","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21","https://www.tenable.com/security/tns-2017-09","https://www.teskalabs.com/blog/teskalabs-bulletin-160826-seacat-sweet32-issue","https://www.vicarius.io/vsociety/posts/cve-2016-2183-detection-sweet32-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2016-2183-mitigate-sweet32-vulnerability"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2183","description":"The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2183","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2183","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2183","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2183","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2183","date":"2026-10-07","epss":0.94697,"percentile":0.99857}],"risk":28.4091,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2183"},"relatedVulnerabilities":[{"id":"CVE-2016-2183","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2183","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2183","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2183","date":"2026-10-07","epss":0.94697,"percentile":0.99857}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00068.html","http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00028.html","http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://packetstormsecurity.com/files/142756/IBM-Informix-Dynamic-Server-DLL-Injection-Code-Execution.html","http://rhn.redhat.com/errata/RHSA-2017-0336.html","http://rhn.redhat.com/errata/RHSA-2017-0337.html","http://rhn.redhat.com/errata/RHSA-2017-0338.html","http://rhn.redhat.com/errata/RHSA-2017-0462.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://seclists.org/fulldisclosure/2017/May/105","http://www-01.ibm.com/support/docview.wss?uid=nas8N1021697","http://www-01.ibm.com/support/docview.wss?uid=swg21991482","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/archive/1/539885/100/0/threaded","http://www.securityfocus.com/archive/1/540341/100/0/threaded","http://www.securityfocus.com/archive/1/541104/100/0/threaded","http://www.securityfocus.com/archive/1/542005/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/539885/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/540129/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/540341/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/541104/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/542005/100/0/threaded","http://www.securityfocus.com/bid/92630","http://www.securityfocus.com/bid/95568","http://www.securitytracker.com/id/1036696","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","http://www.ubuntu.com/usn/USN-3179-1","http://www.ubuntu.com/usn/USN-3194-1","http://www.ubuntu.com/usn/USN-3198-1","http://www.ubuntu.com/usn/USN-3270-1","http://www.ubuntu.com/usn/USN-3372-1","https://access.redhat.com/articles/2548661","https://access.redhat.com/errata/RHSA-2017:1216","https://access.redhat.com/errata/RHSA-2017:2708","https://access.redhat.com/errata/RHSA-2017:2709","https://access.redhat.com/errata/RHSA-2017:2710","https://access.redhat.com/errata/RHSA-2017:3113","https://access.redhat.com/errata/RHSA-2017:3114","https://access.redhat.com/errata/RHSA-2017:3239","https://access.redhat.com/errata/RHSA-2017:3240","https://access.redhat.com/errata/RHSA-2018:2123","https://access.redhat.com/errata/RHSA-2019:1245","https://access.redhat.com/errata/RHSA-2019:2859","https://access.redhat.com/errata/RHSA-2020:0451","https://access.redhat.com/security/cve/cve-2016-2183","https://blog.cryptographyengineering.com/2016/08/24/attack-of-week-64-bit-ciphers-in-tls/","https://bto.bluecoat.com/security-advisory/sa133","https://bugzilla.redhat.com/show_bug.cgi?id=1369383","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/ssllabs/ssllabs-scan/issues/387#issuecomment-242514633","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05369403","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05369415","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05385680","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05390722","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05390849","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03765en_us","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05309984","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05323116","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05349499","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05356388","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369403","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05369415","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390849","https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://kc.mcafee.com/corporate/index?page=content&id=SB10186","https://kc.mcafee.com/corporate/index?page=content&id=SB10197","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://kc.mcafee.com/corporate/index?page=content&id=SB10310","https://nakedsecurity.sophos.com/2016/08/25/anatomy-of-a-cryptographic-collision-the-sweet32-attack/","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://seclists.org/bugtraq/2018/Nov/21","https://security.gentoo.org/glsa/201612-16","https://security.gentoo.org/glsa/201701-65","https://security.gentoo.org/glsa/201707-01","https://security.netapp.com/advisory/ntap-20160915-0001/","https://security.netapp.com/advisory/ntap-20170119-0001/","https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03158613","https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03286178","https://support.f5.com/csp/article/K13167034","https://sweet32.info/","https://wiki.opendaylight.org/view/Security_Advisories","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.exploit-db.com/exploits/42091/","https://www.ietf.org/mail-archive/web/tls/current/msg04560.html","https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008","https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2016/august/new-practical-attacks-on-64-bit-block-ciphers-3des-blowfish/","https://www.openssl.org/blog/blog/2016/08/24/sweet32/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.sigsac.org/ccs/CCS2016/accepted-papers/","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21","https://www.tenable.com/security/tns-2017-09","https://www.teskalabs.com/blog/teskalabs-bulletin-160826-seacat-sweet32-issue","https://www.vicarius.io/vsociety/posts/cve-2016-2183-detection-sweet32-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2016-2183-mitigate-sweet32-vulnerability"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2183","description":"The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack."}]},{"artifact":{"id":"328fe217962e5779","cpes":["cpe:2.3:a:sudo:sudo:1.8.9p5-1ubuntu1.2:*:*:*:*:*:*:*"],"name":"sudo","purl":"pkg:deb/ubuntu/sudo@1.8.9p5-1ubuntu1.2?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.8.9p5-1ubuntu1.2","language":"","licenses":["BSD-3-Clause","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/sudo/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/sudo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.list"},{"path":"/var/lib/dpkg/info/sudo.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.postinst"},{"path":"/var/lib/dpkg/info/sudo.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.postrm"},{"path":"/var/lib/dpkg/info/sudo.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.preinst"},{"path":"/var/lib/dpkg/info/sudo.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-22809","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sudo","version":"1.8.9p5-1ubuntu1.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-22809","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-22809","cwe":"CWE-269","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-22809","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-22809","date":"2026-10-07","epss":0.55367,"percentile":0.99012}],"risk":27.6835,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-22809"},"relatedVulnerabilities":[{"id":"CVE-2023-22809","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-22809","cwe":"CWE-269","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-22809","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-22809","date":"2026-10-07","epss":0.55367,"percentile":0.99012}],"urls":["http://packetstormsecurity.com/files/171644/sudo-1.9.12p1-Privilege-Escalation.html","http://packetstormsecurity.com/files/172509/Sudoedit-Extra-Arguments-Privilege-Escalation.html","http://packetstormsecurity.com/files/174234/Cisco-ThousandEyes-Enterprise-Agent-Virtual-Appliance-Arbitrary-File-Modification.html","http://seclists.org/fulldisclosure/2023/Aug/21","http://www.openwall.com/lists/oss-security/2023/01/19/1","https://lists.debian.org/debian-lts-announce/2023/01/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2QDGFCGAV5QRJCE6IXRXIS4XJHS57DDH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4YNBTTKTRT2ME3NTSXAPTOKYUE47XHZ/","https://security.gentoo.org/glsa/202305-12","https://security.netapp.com/advisory/ntap-20230127-0015/","https://support.apple.com/kb/HT213758","https://www.debian.org/security/2023/dsa-5321","https://www.sudo.ws/security/advisories/sudoedit_any/","https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-22809","description":"In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a \"--\" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value."}]},{"artifact":{"id":"3695a31b2933dc8f","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6210","versionConstraint":"< 1:6.6p1-2ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6210","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.8"],"available":[{"date":"2016-08-15","kind":"advisory","version":"1:6.6p1-2ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6210","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-6210","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-6210","date":"2026-10-07","epss":0.88944,"percentile":0.99777}],"risk":26.683200000000003,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6210"},"relatedVulnerabilities":[{"id":"CVE-2016-6210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6210","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-6210","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-6210","date":"2026-10-07","epss":0.88944,"percentile":0.99777}],"urls":["http://seclists.org/fulldisclosure/2016/Jul/51","http://www.debian.org/security/2016/dsa-3626","http://www.securityfocus.com/bid/91812","http://www.securitytracker.com/id/1036319","https://access.redhat.com/errata/RHSA-2017:2029","https://access.redhat.com/errata/RHSA-2017:2563","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://security.gentoo.org/glsa/201612-18","https://security.netapp.com/advisory/ntap-20190206-0001/","https://www.exploit-db.com/exploits/40113/","https://www.exploit-db.com/exploits/40136/","https://www.openssh.com/txt/release-7.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6210","description":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided."}]},{"artifact":{"id":"54d7c6e40533c708","cpes":["cpe:2.3:a:openssh-server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-server","purl":"pkg:deb/ubuntu/openssh-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.config","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.config"},{"path":"/var/lib/dpkg/info/openssh-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.list"},{"path":"/var/lib/dpkg/info/openssh-server.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postinst"},{"path":"/var/lib/dpkg/info/openssh-server.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postrm"},{"path":"/var/lib/dpkg/info/openssh-server.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.preinst"},{"path":"/var/lib/dpkg/info/openssh-server.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.prerm"},{"path":"/var/lib/dpkg/info/openssh-server.templates","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.templates"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6210","versionConstraint":"< 1:6.6p1-2ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6210","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.8"],"available":[{"date":"2016-08-15","kind":"advisory","version":"1:6.6p1-2ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6210","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-6210","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-6210","date":"2026-10-07","epss":0.88944,"percentile":0.99777}],"risk":26.683200000000003,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6210"},"relatedVulnerabilities":[{"id":"CVE-2016-6210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6210","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-6210","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-6210","date":"2026-10-07","epss":0.88944,"percentile":0.99777}],"urls":["http://seclists.org/fulldisclosure/2016/Jul/51","http://www.debian.org/security/2016/dsa-3626","http://www.securityfocus.com/bid/91812","http://www.securitytracker.com/id/1036319","https://access.redhat.com/errata/RHSA-2017:2029","https://access.redhat.com/errata/RHSA-2017:2563","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://security.gentoo.org/glsa/201612-18","https://security.netapp.com/advisory/ntap-20190206-0001/","https://www.exploit-db.com/exploits/40113/","https://www.exploit-db.com/exploits/40136/","https://www.openssh.com/txt/release-7.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6210","description":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided."}]},{"artifact":{"id":"b3db4be88de03e2f","cpes":["cpe:2.3:a:openssh-sftp-server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp-server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-sftp-server","purl":"pkg:deb/ubuntu/openssh-sftp-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-sftp-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.list"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6210","versionConstraint":"< 1:6.6p1-2ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6210","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.8"],"available":[{"date":"2016-08-15","kind":"advisory","version":"1:6.6p1-2ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6210","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-6210","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-6210","date":"2026-10-07","epss":0.88944,"percentile":0.99777}],"risk":26.683200000000003,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6210"},"relatedVulnerabilities":[{"id":"CVE-2016-6210","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6210","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-6210","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-6210","date":"2026-10-07","epss":0.88944,"percentile":0.99777}],"urls":["http://seclists.org/fulldisclosure/2016/Jul/51","http://www.debian.org/security/2016/dsa-3626","http://www.securityfocus.com/bid/91812","http://www.securitytracker.com/id/1036319","https://access.redhat.com/errata/RHSA-2017:2029","https://access.redhat.com/errata/RHSA-2017:2563","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://security.gentoo.org/glsa/201612-18","https://security.netapp.com/advisory/ntap-20190206-0001/","https://www.exploit-db.com/exploits/40113/","https://www.exploit-db.com/exploits/40136/","https://www.openssh.com/txt/release-7.3"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6210","description":"sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35592","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35592","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"risk":26.2455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35592"},"relatedVulnerabilities":[{"id":"CVE-2021-35592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1228/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35592","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35592","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35592","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"risk":26.2455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35592"},"relatedVulnerabilities":[{"id":"CVE-2021-35592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1228/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35592","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35592","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35592","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"risk":26.2455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35592"},"relatedVulnerabilities":[{"id":"CVE-2021-35592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1228/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35592","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35592","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35592","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"risk":26.2455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35592"},"relatedVulnerabilities":[{"id":"CVE-2021-35592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1228/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35592","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35592","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35592","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"risk":26.2455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35592"},"relatedVulnerabilities":[{"id":"CVE-2021-35592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1228/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35592","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35592","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35592","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"risk":26.2455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35592"},"relatedVulnerabilities":[{"id":"CVE-2021-35592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1228/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35592","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35592","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35592","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"risk":26.2455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35592"},"relatedVulnerabilities":[{"id":"CVE-2021-35592","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35592","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35592","date":"2026-10-07","epss":0.52491,"percentile":0.98939}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1228/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35592","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"a9e4b54eee4ab8e5","cpes":["cpe:2.3:a:klibc-utils:klibc-utils:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:klibc-utils:klibc_utils:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:klibc_utils:klibc-utils:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:klibc_utils:klibc_utils:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:klibc:klibc-utils:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:klibc:klibc_utils:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"klibc-utils","purl":"pkg:deb/ubuntu/klibc-utils@2.0.3-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=klibc","type":"deb","version":"2.0.3-0ubuntu1.14.04.1","language":"","licenses":["sha256:d0f580bd7629b15b6bb1b36468b51182545a8002612a030fca39fec2e3203707"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libklibc/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/klibc-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/klibc-utils.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/klibc-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/klibc-utils.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/klibc-utils.list"},{"path":"/var/lib/dpkg/info/klibc-utils.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/klibc-utils.postinst"}],"upstreams":[{"name":"klibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-25032","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"klibc","version":"2.0.3-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-25032","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-10-07","epss":0.51733,"percentile":0.98921}],"risk":25.8665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-25032"},"relatedVulnerabilities":[{"id":"CVE-2018-25032","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-10-07","epss":0.51733,"percentile":0.98921}],"urls":["http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","http://www.openwall.com/lists/oss-security/2022/03/25/2","http://www.openwall.com/lists/oss-security/2022/03/26/1","https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf","https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531","https://github.com/madler/zlib/compare/v1.2.11...v1.2.12","https://github.com/madler/zlib/issues/605","https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html","https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html","https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/","https://security.gentoo.org/glsa/202210-42","https://security.netapp.com/advisory/ntap-20220526-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5111","https://www.openwall.com/lists/oss-security/2022/03/24/1","https://www.openwall.com/lists/oss-security/2022/03/28/1","https://www.openwall.com/lists/oss-security/2022/03/28/3","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-333517.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-565386.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-25032","description":"zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches."}]},{"artifact":{"id":"746a569619b5b5e0","cpes":["cpe:2.3:a:libklibc:libklibc:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"libklibc","purl":"pkg:deb/ubuntu/libklibc@2.0.3-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=klibc","type":"deb","version":"2.0.3-0ubuntu1.14.04.1","language":"","licenses":["sha256:d0f580bd7629b15b6bb1b36468b51182545a8002612a030fca39fec2e3203707"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libklibc/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libklibc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libklibc.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libklibc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libklibc.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libklibc.list"}],"upstreams":[{"name":"klibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-25032","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"klibc","version":"2.0.3-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-25032","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-10-07","epss":0.51733,"percentile":0.98921}],"risk":25.8665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-25032"},"relatedVulnerabilities":[{"id":"CVE-2018-25032","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-10-07","epss":0.51733,"percentile":0.98921}],"urls":["http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","http://www.openwall.com/lists/oss-security/2022/03/25/2","http://www.openwall.com/lists/oss-security/2022/03/26/1","https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf","https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531","https://github.com/madler/zlib/compare/v1.2.11...v1.2.12","https://github.com/madler/zlib/issues/605","https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html","https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html","https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/","https://security.gentoo.org/glsa/202210-42","https://security.netapp.com/advisory/ntap-20220526-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5111","https://www.openwall.com/lists/oss-security/2022/03/24/1","https://www.openwall.com/lists/oss-security/2022/03/28/1","https://www.openwall.com/lists/oss-security/2022/03/28/3","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-333517.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-565386.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-25032","description":"zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches."}]},{"artifact":{"id":"a1d1894adfb63c2e","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-1ubuntu1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/ubuntu/zlib1g@1%3A1.2.8.dfsg-1ubuntu1?arch=amd64&distro=ubuntu-14.04&upstream=zlib","type":"deb","version":"1:1.2.8.dfsg-1ubuntu1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-25032","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-1ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-25032","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-10-07","epss":0.51733,"percentile":0.98921}],"risk":25.8665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-25032"},"relatedVulnerabilities":[{"id":"CVE-2018-25032","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-25032","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-25032","date":"2026-10-07","epss":0.51733,"percentile":0.98921}],"urls":["http://seclists.org/fulldisclosure/2022/May/33","http://seclists.org/fulldisclosure/2022/May/35","http://seclists.org/fulldisclosure/2022/May/38","http://www.openwall.com/lists/oss-security/2022/03/25/2","http://www.openwall.com/lists/oss-security/2022/03/26/1","https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf","https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531","https://github.com/madler/zlib/compare/v1.2.11...v1.2.12","https://github.com/madler/zlib/issues/605","https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html","https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html","https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/","https://security.gentoo.org/glsa/202210-42","https://security.netapp.com/advisory/ntap-20220526-0009/","https://security.netapp.com/advisory/ntap-20220729-0004/","https://support.apple.com/kb/HT213255","https://support.apple.com/kb/HT213256","https://support.apple.com/kb/HT213257","https://www.debian.org/security/2022/dsa-5111","https://www.openwall.com/lists/oss-security/2022/03/24/1","https://www.openwall.com/lists/oss-security/2022/03/28/1","https://www.openwall.com/lists/oss-security/2022/03/28/3","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/html/ssa-333517.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-419740.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-565386.html","https://cert-portal.siemens.com/productcert/html/ssa-942865.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-25032","description":"zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches."}]},{"artifact":{"id":"df1837354f8ead15","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.1.0-4ubuntu1.3?arch=amd64&distro=ubuntu-14.04&upstream=expat","type":"deb","version":"2.1.0-4ubuntu1.3","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-25236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"expat","version":"2.1.0-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-25236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-25236","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25236","cwe":"CWE-668","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25236","date":"2026-10-07","epss":0.34174,"percentile":0.98369}],"risk":25.6305,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-25236"},"relatedVulnerabilities":[{"id":"CVE-2022-25236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25236","cwe":"CWE-668","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25236","cwe":"CWE-668","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25236","date":"2026-10-07","epss":0.34174,"percentile":0.98369}],"urls":["http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html","http://www.openwall.com/lists/oss-security/2022/02/19/1","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/561","https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/","https://security.gentoo.org/glsa/202209-24","https://security.netapp.com/advisory/ntap-20220303-0008/","https://www.debian.org/security/2022/dsa-5085","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25236","description":"xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35593","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35593","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35593"},"relatedVulnerabilities":[{"id":"CVE-2021-35593","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1229/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35593","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35594","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35594"},"relatedVulnerabilities":[{"id":"CVE-2021-35594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1227/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35594","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35593","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35593","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35593"},"relatedVulnerabilities":[{"id":"CVE-2021-35593","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1229/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35593","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35594","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35594"},"relatedVulnerabilities":[{"id":"CVE-2021-35594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1227/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35594","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35593","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35593","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35593"},"relatedVulnerabilities":[{"id":"CVE-2021-35593","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1229/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35593","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35594","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35594"},"relatedVulnerabilities":[{"id":"CVE-2021-35594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1227/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35594","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35593","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35593","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35593"},"relatedVulnerabilities":[{"id":"CVE-2021-35593","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1229/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35593","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35594","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35594"},"relatedVulnerabilities":[{"id":"CVE-2021-35594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1227/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35594","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35593","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35593","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35593"},"relatedVulnerabilities":[{"id":"CVE-2021-35593","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1229/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35593","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35594","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35594"},"relatedVulnerabilities":[{"id":"CVE-2021-35594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1227/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35594","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35593","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35593","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35593"},"relatedVulnerabilities":[{"id":"CVE-2021-35593","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1229/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35593","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35594","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35594"},"relatedVulnerabilities":[{"id":"CVE-2021-35594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1227/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35594","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35593","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35593","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35593"},"relatedVulnerabilities":[{"id":"CVE-2021-35593","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35593","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35593","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1229/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35593","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35594","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35594","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35594"},"relatedVulnerabilities":[{"id":"CVE-2021-35594","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35594","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35594","date":"2026-10-07","epss":0.51136,"percentile":0.98909}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1227/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35594","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35598","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35598","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35598"},"relatedVulnerabilities":[{"id":"CVE-2021-35598","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1230/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35598","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35598","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35598","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35598"},"relatedVulnerabilities":[{"id":"CVE-2021-35598","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1230/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35598","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35598","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35598","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35598"},"relatedVulnerabilities":[{"id":"CVE-2021-35598","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1230/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35598","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35598","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35598","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35598"},"relatedVulnerabilities":[{"id":"CVE-2021-35598","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1230/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35598","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35598","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35598","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35598"},"relatedVulnerabilities":[{"id":"CVE-2021-35598","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1230/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35598","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35598","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35598","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35598"},"relatedVulnerabilities":[{"id":"CVE-2021-35598","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1230/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35598","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35598","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35598","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"risk":25.568,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35598"},"relatedVulnerabilities":[{"id":"CVE-2021-35598","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-35598","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-35598","date":"2026-10-07","epss":0.51136,"percentile":0.98908}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1230/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35598","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3712","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3712","date":"2026-10-07","epss":0.50445,"percentile":0.98887}],"risk":25.222499999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3712"},"relatedVulnerabilities":[{"id":"CVE-2021-3712","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3712","date":"2026-10-07","epss":0.50445,"percentile":0.98887}],"urls":["http://www.openwall.com/lists/oss-security/2021/08/26/2","https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=94d23fcff9b2a7a8368dfe52214d5c2569882c11","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ccb0a11145ee72b042d10593a64eaf9e8a55ec12","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20210827-0010/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4963","https://www.openssl.org/news/secadv/20210824.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-16","https://www.tenable.com/security/tns-2022-02","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-244969.html","https://cert-portal.siemens.com/productcert/html/ssa-389290.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3712","description":"ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3712","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3712","date":"2026-10-07","epss":0.50445,"percentile":0.98887}],"risk":25.222499999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3712"},"relatedVulnerabilities":[{"id":"CVE-2021-3712","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3712","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3712","date":"2026-10-07","epss":0.50445,"percentile":0.98887}],"urls":["http://www.openwall.com/lists/oss-security/2021/08/26/2","https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=94d23fcff9b2a7a8368dfe52214d5c2569882c11","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ccb0a11145ee72b042d10593a64eaf9e8a55ec12","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r18995de860f0e63635f3008fd2a6aca82394249476d21691e7c59c9e%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rad5d9f83f0d11fb3f8bb148d179b8a9ad7c6a17f18d70e5805a713d1%40%3Cdev.tomcat.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/09/msg00014.html","https://lists.debian.org/debian-lts-announce/2021/09/msg00021.html","https://security.gentoo.org/glsa/202209-02","https://security.gentoo.org/glsa/202210-02","https://security.netapp.com/advisory/ntap-20210827-0010/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4963","https://www.openssl.org/news/secadv/20210824.txt","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-16","https://www.tenable.com/security/tns-2022-02","https://cert-portal.siemens.com/productcert/html/ssa-019200.html","https://cert-portal.siemens.com/productcert/html/ssa-028723.html","https://cert-portal.siemens.com/productcert/html/ssa-244969.html","https://cert-portal.siemens.com/productcert/html/ssa-389290.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3712","description":"ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own \"d2i\" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the \"data\" and \"length\" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the \"data\" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y)."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35621","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35621","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"risk":25.008999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35621"},"relatedVulnerabilities":[{"id":"CVE-2021-35621","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1232/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35621","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35621","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35621","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"risk":25.008999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35621"},"relatedVulnerabilities":[{"id":"CVE-2021-35621","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1232/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35621","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35621","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35621","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"risk":25.008999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35621"},"relatedVulnerabilities":[{"id":"CVE-2021-35621","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1232/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35621","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35621","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35621","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"risk":25.008999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35621"},"relatedVulnerabilities":[{"id":"CVE-2021-35621","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1232/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35621","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35621","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35621","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"risk":25.008999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35621"},"relatedVulnerabilities":[{"id":"CVE-2021-35621","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1232/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35621","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35621","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35621","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"risk":25.008999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35621"},"relatedVulnerabilities":[{"id":"CVE-2021-35621","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1232/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35621","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-35621","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-35621","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"risk":25.008999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-35621"},"relatedVulnerabilities":[{"id":"CVE-2021-35621","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:H/Au:S/C:P/I:P/A:P","metrics":{"baseScore":4,"impactScore":6.5,"exploitabilityScore":2.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-35621","date":"2026-10-07","epss":0.50018,"percentile":0.98877}],"urls":["https://security.netapp.com/advisory/ntap-20211022-0003/","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-1232/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-35621","description":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). Supported versions that are affected are 7.4.33 and prior, 7.5.23 and prior, 7.6.19 and prior and 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Cluster. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-5436","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5436","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-07","epss":0.49739,"percentile":0.98869}],"risk":24.8695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5436"},"relatedVulnerabilities":[{"id":"CVE-2019-5436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-07","epss":0.49739,"percentile":0.98869}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html","http://www.openwall.com/lists/oss-security/2019/09/11/6","https://curl.haxx.se/docs/CVE-2019-5436.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20190606-0004/","https://support.f5.com/csp/article/K55133295","https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5436","description":"A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5436","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5436","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-07","epss":0.49739,"percentile":0.98869}],"risk":24.8695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5436"},"relatedVulnerabilities":[{"id":"CVE-2019-5436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-07","epss":0.49739,"percentile":0.98869}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html","http://www.openwall.com/lists/oss-security/2019/09/11/6","https://curl.haxx.se/docs/CVE-2019-5436.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20190606-0004/","https://support.f5.com/csp/article/K55133295","https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5436","description":"A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5436","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5436","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-07","epss":0.49739,"percentile":0.98869}],"risk":24.8695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5436"},"relatedVulnerabilities":[{"id":"CVE-2019-5436","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5436","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5436","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5436","date":"2026-10-07","epss":0.49739,"percentile":0.98869}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00017.html","http://www.openwall.com/lists/oss-security/2019/09/11/6","https://curl.haxx.se/docs/CVE-2019-5436.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SMG3V4VTX2SE3EW3HQTN3DDLQBTORQC2/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20190606-0004/","https://support.f5.com/csp/article/K55133295","https://support.f5.com/csp/article/K55133295?utm_source=f5support&amp%3Butm_medium=RSS","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5436","description":"A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1."}]},{"artifact":{"id":"c3d1461911450c05","cpes":["cpe:2.3:a:libdb5.3:libdb5.3:5.3.28-3ubuntu3:*:*:*:*:*:*:*"],"name":"libdb5.3","purl":"pkg:deb/ubuntu/libdb5.3@5.3.28-3ubuntu3?arch=amd64&distro=ubuntu-14.04&upstream=db5.3","type":"deb","version":"5.3.28-3ubuntu3","language":"","licenses":["sha256:b3bbc6fbb3f2a0e6a487e953eb8c3cc4bdb6f4150f7f51d20b1e9a3c8ef92d3d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdb5.3/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/libdb5.3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdb5.3:amd64.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/libdb5.3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"db5.3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-8457","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"db5.3","version":"5.3.28-3ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-8457","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-10-07","epss":0.45426,"percentile":0.9876}],"risk":22.713,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-8457"},"relatedVulnerabilities":[{"id":"CVE-2019-8457","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-10-07","epss":0.45426,"percentile":0.9876}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/","https://security.netapp.com/advisory/ntap-20190606-0002/","https://usn.ubuntu.com/4004-1/","https://usn.ubuntu.com/4004-2/","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.sqlite.org/releaselog/3_28_0.html","https://www.sqlite.org/src/info/90acdbfce9c08858"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-8457","description":"SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables."}]},{"artifact":{"id":"9f127744e4033e99","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.8.2-1ubuntu2.1?arch=amd64&distro=ubuntu-14.04&upstream=sqlite3","type":"deb","version":"3.8.2-1ubuntu2.1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-8457","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sqlite3","version":"3.8.2-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-8457","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-10-07","epss":0.45426,"percentile":0.9876}],"risk":22.713,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-8457"},"relatedVulnerabilities":[{"id":"CVE-2019-8457","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Secondary","source":"cve@checkpoint.com"},{"cve":"CVE-2019-8457","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-8457","date":"2026-10-07","epss":0.45426,"percentile":0.9876}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/","https://security.netapp.com/advisory/ntap-20190606-0002/","https://usn.ubuntu.com/4004-1/","https://usn.ubuntu.com/4004-2/","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.sqlite.org/releaselog/3_28_0.html","https://www.sqlite.org/src/info/90acdbfce9c08858"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-8457","description":"SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables."}]},{"artifact":{"id":"b81880fd126d2468","cpes":["cpe:2.3:a:isc-dhcp-client:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-client:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*"],"name":"isc-dhcp-client","purl":"pkg:deb/ubuntu/isc-dhcp-client@4.2.4-7ubuntu12.4?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.4","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/isc-dhcp-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.list"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postinst"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postrm"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.preinst"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.4-7ubuntu12.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2774","versionConstraint":"< 4.2.4-7ubuntu12.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2774","fix":{"state":"fixed","versions":["4.2.4-7ubuntu12.12"],"available":[{"date":"2018-03-01","kind":"advisory","version":"4.2.4-7ubuntu12.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2774","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2774","date":"2026-10-07","epss":0.73622,"percentile":0.99461}],"risk":22.086599999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2774"},"relatedVulnerabilities":[{"id":"CVE-2016-2774","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2774","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2774","date":"2026-10-07","epss":0.73622,"percentile":0.99461}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183458.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183640.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00066.html","http://rhn.redhat.com/errata/RHSA-2016-2590.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/84208","http://www.securitytracker.com/id/1035196","https://kb.isc.org/article/AA-01354","https://lists.debian.org/debian-lts-announce/2019/11/msg00023.html","https://usn.ubuntu.com/3586-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2774","description":"ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions."}]},{"artifact":{"id":"c0a53a3f1b3af4cc","cpes":["cpe:2.3:a:isc-dhcp-common:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-common:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*"],"name":"isc-dhcp-common","purl":"pkg:deb/ubuntu/isc-dhcp-common@4.2.4-7ubuntu12.4?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.4","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-common/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/isc-dhcp-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.list"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.4-7ubuntu12.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2774","versionConstraint":"< 4.2.4-7ubuntu12.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2774","fix":{"state":"fixed","versions":["4.2.4-7ubuntu12.12"],"available":[{"date":"2018-03-01","kind":"advisory","version":"4.2.4-7ubuntu12.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2774","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2774","date":"2026-10-07","epss":0.73622,"percentile":0.99461}],"risk":22.086599999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2774"},"relatedVulnerabilities":[{"id":"CVE-2016-2774","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2774","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2774","date":"2026-10-07","epss":0.73622,"percentile":0.99461}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183458.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183640.html","http://lists.opensuse.org/opensuse-updates/2016-07/msg00066.html","http://rhn.redhat.com/errata/RHSA-2016-2590.html","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/84208","http://www.securitytracker.com/id/1035196","https://kb.isc.org/article/AA-01354","https://lists.debian.org/debian-lts-announce/2019/11/msg00023.html","https://usn.ubuntu.com/3586-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2774","description":"ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions."}]},{"artifact":{"id":"b81880fd126d2468","cpes":["cpe:2.3:a:isc-dhcp-client:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-client:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*"],"name":"isc-dhcp-client","purl":"pkg:deb/ubuntu/isc-dhcp-client@4.2.4-7ubuntu12.4?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.4","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/isc-dhcp-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.list"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postinst"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postrm"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.preinst"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.4-7ubuntu12.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3144","versionConstraint":"< 4.2.4-7ubuntu12.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-3144","fix":{"state":"fixed","versions":["4.2.4-7ubuntu12.12"],"available":[{"date":"2018-03-01","kind":"advisory","version":"4.2.4-7ubuntu12.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3144","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3144","date":"2026-10-07","epss":0.72724,"percentile":0.99436}],"risk":21.8172,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-3144"},"relatedVulnerabilities":[{"id":"CVE-2017-3144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3144","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3144","date":"2026-10-07","epss":0.72724,"percentile":0.99436}],"urls":["http://www.securityfocus.com/bid/102726","http://www.securitytracker.com/id/1040194","https://access.redhat.com/errata/RHSA-2018:0158","https://kb.isc.org/docs/aa-01541","https://usn.ubuntu.com/3586-1/","https://www.debian.org/security/2018/dsa-4133"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3144","description":"A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested."}]},{"artifact":{"id":"c0a53a3f1b3af4cc","cpes":["cpe:2.3:a:isc-dhcp-common:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-common:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*"],"name":"isc-dhcp-common","purl":"pkg:deb/ubuntu/isc-dhcp-common@4.2.4-7ubuntu12.4?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.4","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-common/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/isc-dhcp-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.list"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.4-7ubuntu12.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3144","versionConstraint":"< 4.2.4-7ubuntu12.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-3144","fix":{"state":"fixed","versions":["4.2.4-7ubuntu12.12"],"available":[{"date":"2018-03-01","kind":"advisory","version":"4.2.4-7ubuntu12.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3144","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3144","date":"2026-10-07","epss":0.72724,"percentile":0.99436}],"risk":21.8172,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-3144"},"relatedVulnerabilities":[{"id":"CVE-2017-3144","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3144","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3144","date":"2026-10-07","epss":0.72724,"percentile":0.99436}],"urls":["http://www.securityfocus.com/bid/102726","http://www.securitytracker.com/id/1040194","https://access.redhat.com/errata/RHSA-2018:0158","https://kb.isc.org/docs/aa-01541","https://usn.ubuntu.com/3586-1/","https://www.debian.org/security/2018/dsa-4133"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3144","description":"A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server. Affects ISC DHCP 4.1.0 to 4.1-ESV-R15, 4.2.0 to 4.2.8, 4.3.0 to 4.3.6. Older versions may also be affected but are well beyond their end-of-life (EOL). Releases prior to 4.1.0 have not been tested."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-21887","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-21887","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"risk":21.701500000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-21887"},"relatedVulnerabilities":[{"id":"CVE-2023-21887","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"urls":["https://www.oracle.com/security-alerts/cpujan2023.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-21887","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS).  Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-21887","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-21887","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"risk":21.701500000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-21887"},"relatedVulnerabilities":[{"id":"CVE-2023-21887","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"urls":["https://www.oracle.com/security-alerts/cpujan2023.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-21887","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS).  Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-21887","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-21887","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"risk":21.701500000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-21887"},"relatedVulnerabilities":[{"id":"CVE-2023-21887","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"urls":["https://www.oracle.com/security-alerts/cpujan2023.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-21887","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS).  Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-21887","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-21887","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"risk":21.701500000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-21887"},"relatedVulnerabilities":[{"id":"CVE-2023-21887","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"urls":["https://www.oracle.com/security-alerts/cpujan2023.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-21887","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS).  Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-21887","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-21887","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"risk":21.701500000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-21887"},"relatedVulnerabilities":[{"id":"CVE-2023-21887","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"urls":["https://www.oracle.com/security-alerts/cpujan2023.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-21887","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS).  Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-21887","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-21887","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"risk":21.701500000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-21887"},"relatedVulnerabilities":[{"id":"CVE-2023-21887","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"urls":["https://www.oracle.com/security-alerts/cpujan2023.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-21887","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS).  Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-21887","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-21887","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"risk":21.701500000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-21887"},"relatedVulnerabilities":[{"id":"CVE-2023-21887","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-21887","date":"2026-10-07","epss":0.43403,"percentile":0.98702}],"urls":["https://www.oracle.com/security-alerts/cpujan2023.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-21887","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS).  Supported versions that are affected are 8.0.31 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6306","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6306","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6306","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6306","date":"2026-10-07","epss":0.41683,"percentile":0.98652}],"risk":20.8415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6306"},"relatedVulnerabilities":[{"id":"CVE-2016-6306","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6306","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6306","date":"2026-10-07","epss":0.41683,"percentile":0.98652}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/93153","http://www.securitytracker.com/id/1036885","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.f5.com/csp/article/K90492697","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.openssl.org/news/secadv/20160922.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6306","description":"The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6306","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6306","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6306","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6306","date":"2026-10-07","epss":0.41683,"percentile":0.98652}],"risk":20.8415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6306"},"relatedVulnerabilities":[{"id":"CVE-2016-6306","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6306","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6306","date":"2026-10-07","epss":0.41683,"percentile":0.98652}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/93153","http://www.securitytracker.com/id/1036885","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=52e623c4cb06fffa9d5e75c60b34b4bc130b12e9","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.f5.com/csp/article/K90492697","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.openssl.org/news/secadv/20160922.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6306","description":"The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2429","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2429","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"risk":20.739,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2429"},"relatedVulnerabilities":[{"id":"CVE-2021-2429","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"urls":["https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-889/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2429","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2429","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2429","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"risk":20.739,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2429"},"relatedVulnerabilities":[{"id":"CVE-2021-2429","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"urls":["https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-889/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2429","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2429","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2429","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"risk":20.739,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2429"},"relatedVulnerabilities":[{"id":"CVE-2021-2429","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"urls":["https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-889/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2429","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2429","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2429","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"risk":20.739,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2429"},"relatedVulnerabilities":[{"id":"CVE-2021-2429","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"urls":["https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-889/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2429","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2429","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2429","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"risk":20.739,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2429"},"relatedVulnerabilities":[{"id":"CVE-2021-2429","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"urls":["https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-889/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2429","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2429","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2429","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"risk":20.739,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2429"},"relatedVulnerabilities":[{"id":"CVE-2021-2429","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"urls":["https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-889/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2429","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2429","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2429","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"risk":20.739,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2429"},"relatedVulnerabilities":[{"id":"CVE-2021-2429","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2429","date":"2026-10-07","epss":0.41478,"percentile":0.98645}],"urls":["https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-889/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2429","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57604ba6c5c65d28","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-3ubuntu4.8:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/ubuntu/libxml2@2.9.1%2Bdfsg1-3ubuntu4.8?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.9.1+dfsg1-3ubuntu4.8","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-40303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-3ubuntu4.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-40303","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-40303","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-40303","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40303","date":"2026-10-07","epss":0.41365,"percentile":0.9864}],"risk":20.6825,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-40303"},"relatedVulnerabilities":[{"id":"CVE-2022-40303","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40303","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-40303","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40303","date":"2026-10-07","epss":0.41365,"percentile":0.9864}],"urls":["http://seclists.org/fulldisclosure/2022/Dec/21","http://seclists.org/fulldisclosure/2022/Dec/24","http://seclists.org/fulldisclosure/2022/Dec/25","http://seclists.org/fulldisclosure/2022/Dec/26","http://seclists.org/fulldisclosure/2022/Dec/27","https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0","https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3","https://security.netapp.com/advisory/ntap-20221209-0003/","https://support.apple.com/kb/HT213531","https://support.apple.com/kb/HT213533","https://support.apple.com/kb/HT213534","https://support.apple.com/kb/HT213535","https://support.apple.com/kb/HT213536"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40303","description":"An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault."}]},{"artifact":{"id":"5729611933088ab4","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.12%2Bdfsg-2ubuntu5.2?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12+dfsg-2ubuntu5.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12+dfsg-2ubuntu5.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12+dfsg-2ubuntu5.4"],"available":[{"date":"2016-03-26","kind":"advisory","version":"1.12+dfsg-2ubuntu5.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-07","epss":0.39969,"percentile":0.98595}],"risk":19.9845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-07","epss":0.39969,"percentile":0.98595}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"ce758c0024b5fdb9","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.12%2Bdfsg-2ubuntu5.2?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12+dfsg-2ubuntu5.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12+dfsg-2ubuntu5.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12+dfsg-2ubuntu5.4"],"available":[{"date":"2016-03-26","kind":"advisory","version":"1.12+dfsg-2ubuntu5.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-07","epss":0.39969,"percentile":0.98595}],"risk":19.9845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-07","epss":0.39969,"percentile":0.98595}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"9a9b8e1c27a04422","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.12%2Bdfsg-2ubuntu5.2?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12+dfsg-2ubuntu5.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12+dfsg-2ubuntu5.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12+dfsg-2ubuntu5.4"],"available":[{"date":"2016-03-26","kind":"advisory","version":"1.12+dfsg-2ubuntu5.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-07","epss":0.39969,"percentile":0.98595}],"risk":19.9845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-07","epss":0.39969,"percentile":0.98595}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"33e67ade259e89cd","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.12%2Bdfsg-2ubuntu5.2?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.12+dfsg-2ubuntu5.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3119","versionConstraint":"< 1.12+dfsg-2ubuntu5.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3119","fix":{"state":"fixed","versions":["1.12+dfsg-2ubuntu5.4"],"available":[{"date":"2016-03-26","kind":"advisory","version":"1.12+dfsg-2ubuntu5.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-07","epss":0.39969,"percentile":0.98595}],"risk":19.9845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3119"},"relatedVulnerabilities":[{"id":"CVE-2016-3119","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","metrics":{"baseScore":3.5,"impactScore":2.9,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3119","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-3119","date":"2026-10-07","epss":0.39969,"percentile":0.98595}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-04/msg00007.html","http://lists.opensuse.org/opensuse-updates/2016-04/msg00055.html","http://rhn.redhat.com/errata/RHSA-2016-2591.html","http://www.securityfocus.com/bid/85392","http://www.securitytracker.com/id/1035399","https://github.com/krb5/krb5/commit/08c642c09c38a9c6454ab43a9b53b2a89b9eef99","https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3119","description":"The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal."}]},{"artifact":{"id":"3695a31b2933dc8f","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6111","versionConstraint":"< 1:6.6p1-2ubuntu2.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-6111","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.13"],"available":[{"date":"2019-03-04","kind":"advisory","version":"1:6.6p1-2ubuntu2.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6111","date":"2026-10-07","epss":0.58204,"percentile":0.99074}],"risk":17.461199999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6111"},"relatedVulnerabilities":[{"id":"CVE-2019-6111","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6111","date":"2026-10-07","epss":0.58204,"percentile":0.99074}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html","http://www.openwall.com/lists/oss-security/2019/04/18/1","http://www.openwall.com/lists/oss-security/2022/08/02/1","http://www.securityfocus.com/bid/106741","https://access.redhat.com/errata/RHSA-2019:3702","https://bugzilla.redhat.com/show_bug.cgi?id=1677794","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/","https://security.gentoo.org/glsa/201903-16","https://security.netapp.com/advisory/ntap-20190213-0001/","https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","https://usn.ubuntu.com/3885-1/","https://usn.ubuntu.com/3885-2/","https://www.debian.org/security/2019/dsa-4387","https://www.exploit-db.com/exploits/46193/","https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6111","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file)."}]},{"artifact":{"id":"54d7c6e40533c708","cpes":["cpe:2.3:a:openssh-server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-server","purl":"pkg:deb/ubuntu/openssh-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.config","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.config"},{"path":"/var/lib/dpkg/info/openssh-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.list"},{"path":"/var/lib/dpkg/info/openssh-server.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postinst"},{"path":"/var/lib/dpkg/info/openssh-server.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postrm"},{"path":"/var/lib/dpkg/info/openssh-server.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.preinst"},{"path":"/var/lib/dpkg/info/openssh-server.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.prerm"},{"path":"/var/lib/dpkg/info/openssh-server.templates","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.templates"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6111","versionConstraint":"< 1:6.6p1-2ubuntu2.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-6111","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.13"],"available":[{"date":"2019-03-04","kind":"advisory","version":"1:6.6p1-2ubuntu2.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6111","date":"2026-10-07","epss":0.58204,"percentile":0.99074}],"risk":17.461199999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6111"},"relatedVulnerabilities":[{"id":"CVE-2019-6111","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6111","date":"2026-10-07","epss":0.58204,"percentile":0.99074}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html","http://www.openwall.com/lists/oss-security/2019/04/18/1","http://www.openwall.com/lists/oss-security/2022/08/02/1","http://www.securityfocus.com/bid/106741","https://access.redhat.com/errata/RHSA-2019:3702","https://bugzilla.redhat.com/show_bug.cgi?id=1677794","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/","https://security.gentoo.org/glsa/201903-16","https://security.netapp.com/advisory/ntap-20190213-0001/","https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","https://usn.ubuntu.com/3885-1/","https://usn.ubuntu.com/3885-2/","https://www.debian.org/security/2019/dsa-4387","https://www.exploit-db.com/exploits/46193/","https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6111","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file)."}]},{"artifact":{"id":"b3db4be88de03e2f","cpes":["cpe:2.3:a:openssh-sftp-server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp-server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-sftp-server","purl":"pkg:deb/ubuntu/openssh-sftp-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-sftp-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.list"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6111","versionConstraint":"< 1:6.6p1-2ubuntu2.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-6111","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.13"],"available":[{"date":"2019-03-04","kind":"advisory","version":"1:6.6p1-2ubuntu2.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6111","date":"2026-10-07","epss":0.58204,"percentile":0.99074}],"risk":17.461199999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6111"},"relatedVulnerabilities":[{"id":"CVE-2019-6111","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6111","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6111","date":"2026-10-07","epss":0.58204,"percentile":0.99074}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html","http://www.openwall.com/lists/oss-security/2019/04/18/1","http://www.openwall.com/lists/oss-security/2022/08/02/1","http://www.securityfocus.com/bid/106741","https://access.redhat.com/errata/RHSA-2019:3702","https://bugzilla.redhat.com/show_bug.cgi?id=1677794","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E","https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/","https://security.gentoo.org/glsa/201903-16","https://security.netapp.com/advisory/ntap-20190213-0001/","https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","https://usn.ubuntu.com/3885-1/","https://usn.ubuntu.com/3885-2/","https://www.debian.org/security/2019/dsa-4387","https://www.exploit-db.com/exploits/46193/","https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6111","description":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file)."}]},{"artifact":{"id":"b37dbcb586168da6","cpes":["cpe:2.3:a:busybox-initramfs:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox-initramfs:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox_initramfs:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox_initramfs:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*"],"name":"busybox-initramfs","purl":"pkg:deb/ubuntu/busybox-initramfs@1%3A1.21.0-1ubuntu1?arch=amd64&distro=ubuntu-14.04&upstream=busybox","type":"deb","version":"1:1.21.0-1ubuntu1","language":"","licenses":["sha256:336d995e819d3a7a3fdbf3f5041c07094f75ee849acb3bb742b7503d45786329"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/busybox-initramfs/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/busybox-initramfs/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/busybox-initramfs.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/busybox-initramfs.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/busybox-initramfs.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/busybox-initramfs.list"}],"upstreams":[{"name":"busybox"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.21.0-1ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000517","versionConstraint":"< 1:1.21.0-1ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"busybox","version":"1:1.21.0-1ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000517","fix":{"state":"fixed","versions":["1:1.21.0-1ubuntu1.4"],"available":[{"date":"2019-04-03","kind":"advisory","version":"1:1.21.0-1ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000517","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000517","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000517","date":"2026-10-07","epss":0.32919,"percentile":0.9832}],"risk":16.4595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000517"},"relatedVulnerabilities":[{"id":"CVE-2018-1000517","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000517","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000517","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000517","date":"2026-10-07","epss":0.32919,"percentile":0.9832}],"urls":["https://git.busybox.net/busybox/commit/?id=8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e","https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html","https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html","https://usn.ubuntu.com/3935-1/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000517","description":"BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can result in heap buffer overflow. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in after commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6303","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6303","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6303","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6303","date":"2026-10-07","epss":0.31985,"percentile":0.98272}],"risk":15.992500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6303"},"relatedVulnerabilities":[{"id":"CVE-2016-6303","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6303","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6303","date":"2026-10-07","epss":0.31985,"percentile":0.98272}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/92984","http://www.securitytracker.com/id/1036885","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1370146","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=55d83bf7c10c7b205fffa23fa7c3977491e56c07","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6303","description":"Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6303","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6303","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6303","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6303","date":"2026-10-07","epss":0.31985,"percentile":0.98272}],"risk":15.992500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6303"},"relatedVulnerabilities":[{"id":"CVE-2016-6303","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6303","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6303","date":"2026-10-07","epss":0.31985,"percentile":0.98272}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.securityfocus.com/bid/92984","http://www.securitytracker.com/id/1036885","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1370146","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=55d83bf7c10c7b205fffa23fa7c3977491e56c07","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6303","description":"Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-10-07","epss":0.52421,"percentile":0.98937}],"risk":15.726299999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2511"},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-10-07","epss":0.52421,"percentile":0.98937}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-2511","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-2511","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-10-07","epss":0.52421,"percentile":0.98937}],"risk":15.726299999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2511"},"relatedVulnerabilities":[{"id":"CVE-2024-2511","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2511","cwe":"CWE-1325","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2024-2511","date":"2026-10-07","epss":0.52421,"percentile":0.98937}],"urls":["https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce","https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d","https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08","https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640","https://www.openssl.org/news/secadv/20240408.txt","http://www.openwall.com/lists/oss-security/2024/04/08/5","https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html","https://security.netapp.com/advisory/ntap-20240503-0013/","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-354112.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-915275.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2511","description":"Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23840","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23840","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23840","date":"2026-10-07","epss":0.50732,"percentile":0.98896}],"risk":15.2196,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23840"},"relatedVulnerabilities":[{"id":"CVE-2021-23840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23840","date":"2026-10-07","epss":0.50732,"percentile":0.98896}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23840","description":"Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-23840","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23840","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23840","date":"2026-10-07","epss":0.50732,"percentile":0.98896}],"risk":15.2196,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23840"},"relatedVulnerabilities":[{"id":"CVE-2021-23840","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23840","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23840","date":"2026-10-07","epss":0.50732,"percentile":0.98896}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6a51b9e1d0cf0bf8515f7201b68fb0a3482b3dc1","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9b1129239f3ebb1d1c98ce9ed41d5c9476c47cb2","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://kc.mcafee.com/corporate/index?page=content&id=SB10366","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23840","description":"Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.26"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0732","versionConstraint":"< 1.0.1f-1ubuntu2.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0732","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.26"],"available":[{"date":"2018-06-26","kind":"advisory","version":"1.0.1f-1ubuntu2.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-07","epss":0.48831,"percentile":0.98849}],"risk":14.649300000000002,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0732"},"relatedVulnerabilities":[{"id":"CVE-2018-0732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-07","epss":0.48831,"percentile":0.98849}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104442","http://www.securitytracker.com/id/1041090","https://access.redhat.com/errata/RHSA-2018:2552","https://access.redhat.com/errata/RHSA-2018:2553","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:1296","https://access.redhat.com/errata/RHSA-2019:1297","https://access.redhat.com/errata/RHSA-2019:1543","https://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-03","https://security.netapp.com/advisory/ntap-20181105-0001/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180612.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0732","description":"During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o)."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.26"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0732","versionConstraint":"< 1.0.1f-1ubuntu2.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0732","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.26"],"available":[{"date":"2018-06-26","kind":"advisory","version":"1.0.1f-1ubuntu2.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-07","epss":0.48831,"percentile":0.98849}],"risk":14.649300000000002,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0732"},"relatedVulnerabilities":[{"id":"CVE-2018-0732","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0732","cwe":"CWE-320","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0732","date":"2026-10-07","epss":0.48831,"percentile":0.98849}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104442","http://www.securitytracker.com/id/1041090","https://access.redhat.com/errata/RHSA-2018:2552","https://access.redhat.com/errata/RHSA-2018:2553","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:1296","https://access.redhat.com/errata/RHSA-2019:1297","https://access.redhat.com/errata/RHSA-2019:1543","https://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-03","https://security.netapp.com/advisory/ntap-20181105-0001/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180612.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0732","description":"During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o)."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2182","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2182","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2182","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2182","date":"2026-10-07","epss":0.46095,"percentile":0.9878}],"risk":13.828499999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2182"},"relatedVulnerabilities":[{"id":"CVE-2016-2182","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2182","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2182","date":"2026-10-07","epss":0.46095,"percentile":0.9878}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92557","http://www.securitytracker.com/id/1036688","http://www.securitytracker.com/id/1037968","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=07bed46f332fce8c1d157689a2cdf915a982ae34","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://source.android.com/security/bulletin/2017-03-01","https://source.android.com/security/bulletin/2017-03-01.html","https://support.f5.com/csp/article/K01276005","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2182","description":"The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2182","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2182","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2182","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2182","date":"2026-10-07","epss":0.46095,"percentile":0.9878}],"risk":13.828499999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2182"},"relatedVulnerabilities":[{"id":"CVE-2016-2182","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2182","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2182","date":"2026-10-07","epss":0.46095,"percentile":0.9878}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92557","http://www.securitytracker.com/id/1036688","http://www.securitytracker.com/id/1037968","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=07bed46f332fce8c1d157689a2cdf915a982ae34","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10171","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://source.android.com/security/bulletin/2017-03-01","https://source.android.com/security/bulletin/2017-03-01.html","https://support.f5.com/csp/article/K01276005","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2182","description":"The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-07","epss":0.27095,"percentile":0.98005}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-07","epss":0.27095,"percentile":0.98005}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-07","epss":0.27095,"percentile":0.98005}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-07","epss":0.27095,"percentile":0.98005}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-07","epss":0.27095,"percentile":0.98005}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-07","epss":0.27095,"percentile":0.98005}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2007-4559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2007-4559","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-07","epss":0.27095,"percentile":0.98005}],"risk":13.547500000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2007-4559"},"relatedVulnerabilities":[{"id":"CVE-2007-4559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2007-4559","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2007-4559","date":"2026-10-07","epss":0.27095,"percentile":0.98005}],"urls":["http://mail.python.org/pipermail/python-dev/2007-August/074290.html","http://mail.python.org/pipermail/python-dev/2007-August/074292.html","http://secunia.com/advisories/26623","http://www.vupen.com/english/advisories/2007/3022","https://bugzilla.redhat.com/show_bug.cgi?id=263261","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/","https://security.gentoo.org/glsa/202309-06","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2007-4559","description":"Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.22"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2177","versionConstraint":"< 1.0.1f-1ubuntu2.22 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2177","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.22"],"available":[{"date":"2017-01-31","kind":"advisory","version":"1.0.1f-1ubuntu2.22"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2177","date":"2026-10-07","epss":0.44505,"percentile":0.98734}],"risk":13.3515,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2177"},"relatedVulnerabilities":[{"id":"CVE-2016-2177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2177","date":"2026-10-07","epss":0.44505,"percentile":0.98734}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.openwall.com/lists/oss-security/2016/06/08/9","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/archive/1/540957/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/540957/100/0/threaded","http://www.securityfocus.com/bid/91319","http://www.securitytracker.com/id/1036088","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","http://www.ubuntu.com/usn/USN-3181-1","https://access.redhat.com/errata/RHSA-2017:0193","https://access.redhat.com/errata/RHSA-2017:0194","https://access.redhat.com/errata/RHSA-2017:1658","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1341705","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=a004e72b95835136d3f1ea90517f706c24c03da7","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03763en_us","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10165","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.f5.com/csp/article/K23873366","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9134-vulnerabilities-within-schneider-electric-floating-license-manager","https://www.schneider-electric.com/en/download/document/SEVD-2018-137-01/","https://www.schneider-electric.com/en/download/document/SEVD-2018-144-01/","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2177","description":"OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.22"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2177","versionConstraint":"< 1.0.1f-1ubuntu2.22 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2177","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.22"],"available":[{"date":"2017-01-31","kind":"advisory","version":"1.0.1f-1ubuntu2.22"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2177","date":"2026-10-07","epss":0.44505,"percentile":0.98734}],"risk":13.3515,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2177"},"relatedVulnerabilities":[{"id":"CVE-2016-2177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2177","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2177","date":"2026-10-07","epss":0.44505,"percentile":0.98734}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160927-openssl","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.openwall.com/lists/oss-security/2016/06/08/9","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/archive/1/540957/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/540957/100/0/threaded","http://www.securityfocus.com/bid/91319","http://www.securitytracker.com/id/1036088","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","http://www.ubuntu.com/usn/USN-3181-1","https://access.redhat.com/errata/RHSA-2017:0193","https://access.redhat.com/errata/RHSA-2017:0194","https://access.redhat.com/errata/RHSA-2017:1658","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1341705","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=a004e72b95835136d3f1ea90517f706c24c03da7","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05302448","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03763en_us","https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05302448","https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10165","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.f5.com/csp/article/K23873366","https://support.hpe.com/hpsc/doc/public/display?docLocale=en&docId=emr_na-hpesbhf03856en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9134-vulnerabilities-within-schneider-electric-floating-license-manager","https://www.schneider-electric.com/en/download/document/SEVD-2018-137-01/","https://www.schneider-electric.com/en/download/document/SEVD-2018-144-01/","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2177","description":"OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c."}]},{"artifact":{"id":"ec58b33e5c146070","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A7.4.052-1ubuntu3?arch=amd64&distro=ubuntu-14.04&upstream=vim","type":"deb","version":"2:7.4.052-1ubuntu3","language":"","licenses":["sha256:8961cb2b1d5fe792b9290a72bd12b2cd49641cdb39026093ed750690034e54d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-common.preinst"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"vim","version":"2:7.4.052-1ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0572","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0572","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0572","date":"2026-10-07","epss":0.26474,"percentile":0.97965}],"risk":13.236999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0572"},"relatedVulnerabilities":[{"id":"CVE-2022-0572","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0572","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0572","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0572","date":"2026-10-07","epss":0.26474,"percentile":0.97965}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://github.com/vim/vim/commit/6e28703a8e41f775f64e442c5d11ce1ff599aa3f","https://huntr.dev/bounties/bf3e0643-03e9-4436-a1c8-74e7111c32bf","https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GOY5YWTP5QUY2EFLCL7AUWA2CV57C37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/","https://support.apple.com/kb/HT213488","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0572","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2."}]},{"artifact":{"id":"927afdc7c4c7d9a0","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A7.4.052-1ubuntu3?arch=amd64&distro=ubuntu-14.04&upstream=vim","type":"deb","version":"2:7.4.052-1ubuntu3","language":"","licenses":["sha256:8961cb2b1d5fe792b9290a72bd12b2cd49641cdb39026093ed750690034e54d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"vim","version":"2:7.4.052-1ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0572","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0572","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0572","date":"2026-10-07","epss":0.26474,"percentile":0.97965}],"risk":13.236999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0572"},"relatedVulnerabilities":[{"id":"CVE-2022-0572","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0572","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0572","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0572","date":"2026-10-07","epss":0.26474,"percentile":0.97965}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://github.com/vim/vim/commit/6e28703a8e41f775f64e442c5d11ce1ff599aa3f","https://huntr.dev/bounties/bf3e0643-03e9-4436-a1c8-74e7111c32bf","https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GOY5YWTP5QUY2EFLCL7AUWA2CV57C37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/","https://support.apple.com/kb/HT213488","https://lists.debian.org/debian-lts-announce/2025/03/msg00023.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0572","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5636","versionConstraint":"< 3.4.3-1ubuntu1~14.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5636","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.5"],"available":[{"date":"2016-11-22","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5636","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5636","date":"2026-10-07","epss":0.2548,"percentile":0.97905}],"risk":12.740000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5636"},"relatedVulnerabilities":[{"id":"CVE-2016-5636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5636","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5636","date":"2026-10-07","epss":0.2548,"percentile":0.97905}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://rhn.redhat.com/errata/RHSA-2016-2586.html","http://www.openwall.com/lists/oss-security/2016/06/15/15","http://www.openwall.com/lists/oss-security/2016/06/16/1","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91247","http://www.securitytracker.com/id/1038138","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bugs.python.org/issue26171","https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2","https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS","https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html","https://security.gentoo.org/glsa/201701-18"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5636","description":"Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5636","versionConstraint":"< 3.4.3-1ubuntu1~14.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5636","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.5"],"available":[{"date":"2016-11-22","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5636","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5636","date":"2026-10-07","epss":0.2548,"percentile":0.97905}],"risk":12.740000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5636"},"relatedVulnerabilities":[{"id":"CVE-2016-5636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5636","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5636","date":"2026-10-07","epss":0.2548,"percentile":0.97905}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://rhn.redhat.com/errata/RHSA-2016-2586.html","http://www.openwall.com/lists/oss-security/2016/06/15/15","http://www.openwall.com/lists/oss-security/2016/06/16/1","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91247","http://www.securitytracker.com/id/1038138","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bugs.python.org/issue26171","https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2","https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS","https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html","https://security.gentoo.org/glsa/201701-18"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5636","description":"Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-5636","versionConstraint":"< 3.4.3-1ubuntu1~14.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5636","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.5"],"available":[{"date":"2016-11-22","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5636","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5636","date":"2026-10-07","epss":0.2548,"percentile":0.97905}],"risk":12.740000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5636"},"relatedVulnerabilities":[{"id":"CVE-2016-5636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5636","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5636","date":"2026-10-07","epss":0.2548,"percentile":0.97905}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://rhn.redhat.com/errata/RHSA-2016-2586.html","http://www.openwall.com/lists/oss-security/2016/06/15/15","http://www.openwall.com/lists/oss-security/2016/06/16/1","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91247","http://www.securitytracker.com/id/1038138","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bugs.python.org/issue26171","https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2","https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS","https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html","https://security.gentoo.org/glsa/201701-18"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5636","description":"Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5636","versionConstraint":"< 3.4.3-1ubuntu1~14.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5636","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.5"],"available":[{"date":"2016-11-22","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5636","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5636","date":"2026-10-07","epss":0.2548,"percentile":0.97905}],"risk":12.740000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5636"},"relatedVulnerabilities":[{"id":"CVE-2016-5636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5636","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5636","date":"2026-10-07","epss":0.2548,"percentile":0.97905}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://rhn.redhat.com/errata/RHSA-2016-2586.html","http://www.openwall.com/lists/oss-security/2016/06/15/15","http://www.openwall.com/lists/oss-security/2016/06/16/1","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91247","http://www.securitytracker.com/id/1038138","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bugs.python.org/issue26171","https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2","https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS","https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html","https://security.gentoo.org/glsa/201701-18"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5636","description":"Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow."}]},{"artifact":{"id":"ec58b33e5c146070","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A7.4.052-1ubuntu3?arch=amd64&distro=ubuntu-14.04&upstream=vim","type":"deb","version":"2:7.4.052-1ubuntu3","language":"","licenses":["sha256:8961cb2b1d5fe792b9290a72bd12b2cd49641cdb39026093ed750690034e54d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-common.preinst"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:7.4.052-1ubuntu3.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-1248","versionConstraint":"< 2:7.4.052-1ubuntu3.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"vim","version":"2:7.4.052-1ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-1248","fix":{"state":"fixed","versions":["2:7.4.052-1ubuntu3.1"],"available":[{"date":"2016-11-29","kind":"advisory","version":"2:7.4.052-1ubuntu3.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1248","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1248","date":"2026-10-07","epss":0.25314,"percentile":0.97895}],"risk":12.656999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-1248"},"relatedVulnerabilities":[{"id":"CVE-2016-1248","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1248","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1248","date":"2026-10-07","epss":0.25314,"percentile":0.97895}],"urls":["http://openwall.com/lists/oss-security/2016/11/22/20","http://rhn.redhat.com/errata/RHSA-2016-2972.html","http://www.debian.org/security/2016/dsa-3722","http://www.securityfocus.com/bid/94478","http://www.securitytracker.com/id/1037338","http://www.ubuntu.com/usn/USN-3139-1","https://anonscm.debian.org/cgit/pkg-vim/vim.git/tree/debian/changelog","https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040","https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a","https://github.com/vim/vim/releases/tag/v8.0.0056","https://lists.debian.org/debian-lts-announce/2016/11/msg00025.html","https://lists.debian.org/debian-security-announce/2016/msg00305.html","https://security.gentoo.org/glsa/201701-29"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1248","description":"vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened."}]},{"artifact":{"id":"927afdc7c4c7d9a0","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A7.4.052-1ubuntu3?arch=amd64&distro=ubuntu-14.04&upstream=vim","type":"deb","version":"2:7.4.052-1ubuntu3","language":"","licenses":["sha256:8961cb2b1d5fe792b9290a72bd12b2cd49641cdb39026093ed750690034e54d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"fix":{"suggestedVersion":"2:7.4.052-1ubuntu3.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-1248","versionConstraint":"< 2:7.4.052-1ubuntu3.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"vim","version":"2:7.4.052-1ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-1248","fix":{"state":"fixed","versions":["2:7.4.052-1ubuntu3.1"],"available":[{"date":"2016-11-29","kind":"advisory","version":"2:7.4.052-1ubuntu3.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1248","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1248","date":"2026-10-07","epss":0.25314,"percentile":0.97895}],"risk":12.656999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-1248"},"relatedVulnerabilities":[{"id":"CVE-2016-1248","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1248","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1248","date":"2026-10-07","epss":0.25314,"percentile":0.97895}],"urls":["http://openwall.com/lists/oss-security/2016/11/22/20","http://rhn.redhat.com/errata/RHSA-2016-2972.html","http://www.debian.org/security/2016/dsa-3722","http://www.securityfocus.com/bid/94478","http://www.securitytracker.com/id/1037338","http://www.ubuntu.com/usn/USN-3139-1","https://anonscm.debian.org/cgit/pkg-vim/vim.git/tree/debian/changelog","https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba72795040","https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a","https://github.com/vim/vim/releases/tag/v8.0.0056","https://lists.debian.org/debian-lts-announce/2016/11/msg00025.html","https://lists.debian.org/debian-security-announce/2016/msg00305.html","https://security.gentoo.org/glsa/201701-29"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1248","description":"vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary code if a file with a specially crafted modeline is opened."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-07","epss":0.40736,"percentile":0.9862}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-07","epss":0.40736,"percentile":0.9862}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-07","epss":0.40736,"percentile":0.9862}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-07","epss":0.40736,"percentile":0.9862}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-07","epss":0.40736,"percentile":0.9862}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-07","epss":0.40736,"percentile":0.9862}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-07","epss":0.40736,"percentile":0.9862}],"risk":12.2208,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23336"},"relatedVulnerabilities":[{"id":"CVE-2021-23336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:P","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"report@snyk.io","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.9,"impactScore":4.3,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-23336","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-23336","date":"2026-10-07","epss":0.40736,"percentile":0.9862}],"urls":["http://www.openwall.com/lists/oss-security/2021/02/19/4","http://www.openwall.com/lists/oss-security/2021/05/01/2","https://github.com/python/cpython/pull/24297","https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E","https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/","https://security.gentoo.org/glsa/202104-04","https://security.netapp.com/advisory/ntap-20210326-0004/","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23336","description":"The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter."}]},{"artifact":{"id":"446829d742a92a16","cpes":["cpe:2.3:a:libgnutls-openssl27:libgnutls-openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-openssl27:libgnutls_openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_openssl27:libgnutls-openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_openssl27:libgnutls_openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*"],"name":"libgnutls-openssl27","purl":"pkg:deb/ubuntu/libgnutls-openssl27@2.12.23-12ubuntu2.5?arch=amd64&distro=ubuntu-14.04&upstream=gnutls26","type":"deb","version":"2.12.23-12ubuntu2.5","language":"","licenses":["sha256:12ca70c4bdcdff66bcbc6405d521f461b0cbb7bccf6d426e3ca6ef63ff132343"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-openssl27/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libgnutls-openssl27/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-openssl27:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libgnutls-openssl27:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls26"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.12.23-12ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8610","versionConstraint":"< 2.12.23-12ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnutls26","version":"2.12.23-12ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-8610","fix":{"state":"fixed","versions":["2.12.23-12ubuntu2.7"],"available":[{"date":"2017-03-20","kind":"advisory","version":"2.12.23-12ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8610","date":"2026-10-07","epss":0.39657,"percentile":0.98585}],"risk":11.8971,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-8610"},"relatedVulnerabilities":[{"id":"CVE-2016-8610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8610","date":"2026-10-07","epss":0.39657,"percentile":0.98585}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0286.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://rhn.redhat.com/errata/RHSA-2017-1415.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/oss-sec/2016/q4/224","http://www.securityfocus.com/bid/93841","http://www.securitytracker.com/id/1037084","https://access.redhat.com/errata/RHSA-2017:1413","https://access.redhat.com/errata/RHSA-2017:1414","https://access.redhat.com/errata/RHSA-2017:1658","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401","https://security.360.cn/cve/CVE-2016-8610/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc","https://security.netapp.com/advisory/ntap-20171130-0001/","https://security.paloaltonetworks.com/CVE-2016-8610","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us","https://www.debian.org/security/2017/dsa-3773","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8610","description":"A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients."}]},{"artifact":{"id":"45c8da2f19469884","cpes":["cpe:2.3:a:libgnutls26:libgnutls26:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*"],"name":"libgnutls26","purl":"pkg:deb/ubuntu/libgnutls26@2.12.23-12ubuntu2.5?arch=amd64&distro=ubuntu-14.04&upstream=gnutls26","type":"deb","version":"2.12.23-12ubuntu2.5","language":"","licenses":["sha256:12ca70c4bdcdff66bcbc6405d521f461b0cbb7bccf6d426e3ca6ef63ff132343"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls26/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libgnutls26/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls26:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libgnutls26:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls26"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.12.23-12ubuntu2.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8610","versionConstraint":"< 2.12.23-12ubuntu2.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnutls26","version":"2.12.23-12ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-8610","fix":{"state":"fixed","versions":["2.12.23-12ubuntu2.7"],"available":[{"date":"2017-03-20","kind":"advisory","version":"2.12.23-12ubuntu2.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8610","date":"2026-10-07","epss":0.39657,"percentile":0.98585}],"risk":11.8971,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-8610"},"relatedVulnerabilities":[{"id":"CVE-2016-8610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8610","date":"2026-10-07","epss":0.39657,"percentile":0.98585}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0286.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://rhn.redhat.com/errata/RHSA-2017-1415.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/oss-sec/2016/q4/224","http://www.securityfocus.com/bid/93841","http://www.securitytracker.com/id/1037084","https://access.redhat.com/errata/RHSA-2017:1413","https://access.redhat.com/errata/RHSA-2017:1414","https://access.redhat.com/errata/RHSA-2017:1658","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401","https://security.360.cn/cve/CVE-2016-8610/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc","https://security.netapp.com/advisory/ntap-20171130-0001/","https://security.paloaltonetworks.com/CVE-2016-8610","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us","https://www.debian.org/security/2017/dsa-3773","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8610","description":"A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.22"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8610","versionConstraint":"< 1.0.1f-1ubuntu2.22 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-8610","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.22"],"available":[{"date":"2017-01-31","kind":"advisory","version":"1.0.1f-1ubuntu2.22"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8610","date":"2026-10-07","epss":0.39657,"percentile":0.98585}],"risk":11.8971,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-8610"},"relatedVulnerabilities":[{"id":"CVE-2016-8610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8610","date":"2026-10-07","epss":0.39657,"percentile":0.98585}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0286.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://rhn.redhat.com/errata/RHSA-2017-1415.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/oss-sec/2016/q4/224","http://www.securityfocus.com/bid/93841","http://www.securitytracker.com/id/1037084","https://access.redhat.com/errata/RHSA-2017:1413","https://access.redhat.com/errata/RHSA-2017:1414","https://access.redhat.com/errata/RHSA-2017:1658","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401","https://security.360.cn/cve/CVE-2016-8610/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc","https://security.netapp.com/advisory/ntap-20171130-0001/","https://security.paloaltonetworks.com/CVE-2016-8610","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us","https://www.debian.org/security/2017/dsa-3773","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8610","description":"A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.22"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-8610","versionConstraint":"< 1.0.1f-1ubuntu2.22 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-8610","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.22"],"available":[{"date":"2017-01-31","kind":"advisory","version":"1.0.1f-1ubuntu2.22"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8610","date":"2026-10-07","epss":0.39657,"percentile":0.98585}],"risk":11.8971,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-8610"},"relatedVulnerabilities":[{"id":"CVE-2016-8610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8610","cwe":"CWE-400","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8610","date":"2026-10-07","epss":0.39657,"percentile":0.98585}],"urls":["http://rhn.redhat.com/errata/RHSA-2017-0286.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://rhn.redhat.com/errata/RHSA-2017-1415.html","http://rhn.redhat.com/errata/RHSA-2017-1659.html","http://seclists.org/oss-sec/2016/q4/224","http://www.securityfocus.com/bid/93841","http://www.securitytracker.com/id/1037084","https://access.redhat.com/errata/RHSA-2017:1413","https://access.redhat.com/errata/RHSA-2017:1414","https://access.redhat.com/errata/RHSA-2017:1658","https://access.redhat.com/errata/RHSA-2017:1801","https://access.redhat.com/errata/RHSA-2017:1802","https://access.redhat.com/errata/RHSA-2017:2493","https://access.redhat.com/errata/RHSA-2017:2494","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401","https://security.360.cn/cve/CVE-2016-8610/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc","https://security.netapp.com/advisory/ntap-20171130-0001/","https://security.paloaltonetworks.com/CVE-2016-8610","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us","https://www.debian.org/security/2017/dsa-3773","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8610","description":"A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-07","epss":0.23293,"percentile":0.97727}],"risk":11.6465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3177"},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-07","epss":0.23293,"percentile":0.97727}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-07","epss":0.23293,"percentile":0.97727}],"risk":11.6465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3177"},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-07","epss":0.23293,"percentile":0.97727}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-07","epss":0.23293,"percentile":0.97727}],"risk":11.6465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3177"},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-07","epss":0.23293,"percentile":0.97727}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-07","epss":0.23293,"percentile":0.97727}],"risk":11.6465,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3177"},"relatedVulnerabilities":[{"id":"CVE-2021-3177","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3177","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3177","date":"2026-10-07","epss":0.23293,"percentile":0.97727}],"urls":["https://bugs.python.org/issue42938","https://github.com/python/cpython/pull/24239","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html","https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BRHOCQYX3QLDGDQGTWQAUUT2GGIZCZUO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CCFZMVRQUKCBQIG5F2CBVADK63NFSE4A/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPE7SMXYUIWPOIZV4DQYXODRXMFX3C5E/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MGSV6BJQLRQ6RKVUXK7JGU7TP4QFGQXC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQPARTLNSFQVMMQHPNBFOCOZOO3TMQNA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXSMBHES3ANXXS2RSO5G6Q24BR4B2PWK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6XJAULOS5JVB2L67NCKKMJ5NTKZJBSD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y4KSYYWMGAKOA2JVCQA422OINT6CKQ7O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDTZVGSXQ7HR7OCGSUHTRNTMBG43OMKU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z7GZV74KM72O2PEJN2C4XP3V5Q5MZUOO/","https://news.ycombinator.com/item?id=26185005","https://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20210226-0003/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3177","description":"Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely."}]},{"artifact":{"id":"57604ba6c5c65d28","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-3ubuntu4.8:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/ubuntu/libxml2@2.9.1%2Bdfsg1-3ubuntu4.8?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.9.1+dfsg1-3ubuntu4.8","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-3ubuntu4.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-7376","versionConstraint":"< 2.9.1+dfsg1-3ubuntu4.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-3ubuntu4.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-7376","fix":{"state":"fixed","versions":["2.9.1+dfsg1-3ubuntu4.10"],"available":[{"date":"2017-09-19","kind":"advisory","version":"2.9.1+dfsg1-3ubuntu4.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-7376","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7376","date":"2026-10-07","epss":0.23286,"percentile":0.97727}],"risk":11.643,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-7376"},"relatedVulnerabilities":[{"id":"CVE-2017-7376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-7376","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-7376","date":"2026-10-07","epss":0.23286,"percentile":0.97727}],"urls":["http://www.securityfocus.com/bid/98877","http://www.securitytracker.com/id/1038623","https://android.googlesource.com/platform/external/libxml2/+/51e0cb2e5ec18eaf6fb331bc573ff27b743898f4","https://bugzilla.redhat.com/show_bug.cgi?id=1462216","https://git.gnome.org/browse/libxml2/commit/?id=5dca9eea1bd4263bfa4d037ab2443de1cd730f7e","https://source.android.com/security/bulletin/2017-06-01","https://www.debian.org/security/2017/dsa-3952"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-7376","description":"Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects."}]},{"artifact":{"id":"9f127744e4033e99","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.8.2-1ubuntu2.1?arch=amd64&distro=ubuntu-14.04&upstream=sqlite3","type":"deb","version":"3.8.2-1ubuntu2.1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-35737","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sqlite3","version":"3.8.2-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-35737","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-35737","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-35737","date":"2026-10-07","epss":0.22774,"percentile":0.97682}],"risk":11.387,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-35737"},"relatedVulnerabilities":[{"id":"CVE-2022-35737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-35737","cwe":"CWE-129","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-35737","date":"2026-10-07","epss":0.22774,"percentile":0.97682}],"urls":["https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/","https://kb.cert.org/vuls/id/720344","https://security.gentoo.org/glsa/202210-40","https://security.netapp.com/advisory/ntap-20220915-0009/","https://sqlite.org/releaselog/3_39_2.html","https://www.sqlite.org/cves.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-35737","description":"SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API."}]},{"artifact":{"id":"3695a31b2933dc8f","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10009","versionConstraint":"< 1:6.6p1-2ubuntu2.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-10009","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.10"],"available":[{"date":"2018-01-22","kind":"advisory","version":"1:6.6p1-2ubuntu2.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10009","date":"2026-10-07","epss":0.37431,"percentile":0.98497}],"risk":11.229299999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-10009"},"relatedVulnerabilities":[{"id":"CVE-2016-10009","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10009","date":"2026-10-07","epss":0.37431,"percentile":0.98497}],"urls":["http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html","http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html","http://seclists.org/fulldisclosure/2023/Jul/31","http://www.openwall.com/lists/oss-security/2016/12/19/2","http://www.openwall.com/lists/oss-security/2023/07/19/9","http://www.openwall.com/lists/oss-security/2023/07/20/1","http://www.securityfocus.com/bid/94968","http://www.securitytracker.com/id/1037490","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637","https://access.redhat.com/errata/RHSA-2017:2029","https://bugs.chromium.org/p/project-zero/issues/detail?id=1009","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5","https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc","https://security.netapp.com/advisory/ntap-20171130-0002/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us","https://usn.ubuntu.com/3538-1/","https://www.exploit-db.com/exploits/40963/","https://www.openssh.com/txt/release-7.4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10009","description":"Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket."}]},{"artifact":{"id":"54d7c6e40533c708","cpes":["cpe:2.3:a:openssh-server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-server","purl":"pkg:deb/ubuntu/openssh-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.config","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.config"},{"path":"/var/lib/dpkg/info/openssh-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.list"},{"path":"/var/lib/dpkg/info/openssh-server.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postinst"},{"path":"/var/lib/dpkg/info/openssh-server.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postrm"},{"path":"/var/lib/dpkg/info/openssh-server.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.preinst"},{"path":"/var/lib/dpkg/info/openssh-server.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.prerm"},{"path":"/var/lib/dpkg/info/openssh-server.templates","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.templates"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10009","versionConstraint":"< 1:6.6p1-2ubuntu2.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-10009","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.10"],"available":[{"date":"2018-01-22","kind":"advisory","version":"1:6.6p1-2ubuntu2.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10009","date":"2026-10-07","epss":0.37431,"percentile":0.98497}],"risk":11.229299999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-10009"},"relatedVulnerabilities":[{"id":"CVE-2016-10009","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10009","date":"2026-10-07","epss":0.37431,"percentile":0.98497}],"urls":["http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html","http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html","http://seclists.org/fulldisclosure/2023/Jul/31","http://www.openwall.com/lists/oss-security/2016/12/19/2","http://www.openwall.com/lists/oss-security/2023/07/19/9","http://www.openwall.com/lists/oss-security/2023/07/20/1","http://www.securityfocus.com/bid/94968","http://www.securitytracker.com/id/1037490","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637","https://access.redhat.com/errata/RHSA-2017:2029","https://bugs.chromium.org/p/project-zero/issues/detail?id=1009","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5","https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc","https://security.netapp.com/advisory/ntap-20171130-0002/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us","https://usn.ubuntu.com/3538-1/","https://www.exploit-db.com/exploits/40963/","https://www.openssh.com/txt/release-7.4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10009","description":"Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket."}]},{"artifact":{"id":"b3db4be88de03e2f","cpes":["cpe:2.3:a:openssh-sftp-server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp-server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-sftp-server","purl":"pkg:deb/ubuntu/openssh-sftp-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-sftp-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.list"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10009","versionConstraint":"< 1:6.6p1-2ubuntu2.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-10009","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.10"],"available":[{"date":"2018-01-22","kind":"advisory","version":"1:6.6p1-2ubuntu2.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10009","date":"2026-10-07","epss":0.37431,"percentile":0.98497}],"risk":11.229299999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-10009"},"relatedVulnerabilities":[{"id":"CVE-2016-10009","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10009","cwe":"CWE-426","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10009","date":"2026-10-07","epss":0.37431,"percentile":0.98497}],"urls":["http://packetstormsecurity.com/files/140261/OpenSSH-Arbitrary-Library-Loading.html","http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html","http://seclists.org/fulldisclosure/2023/Jul/31","http://www.openwall.com/lists/oss-security/2016/12/19/2","http://www.openwall.com/lists/oss-security/2023/07/19/9","http://www.openwall.com/lists/oss-security/2023/07/20/1","http://www.securityfocus.com/bid/94968","http://www.securitytracker.com/id/1037490","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637","https://access.redhat.com/errata/RHSA-2017:2029","https://bugs.chromium.org/p/project-zero/issues/detail?id=1009","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openbsd/src/commit/9476ce1dd37d3c3218d5640b74c34c65e5f4efe5","https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:01.openssh.asc","https://security.netapp.com/advisory/ntap-20171130-0002/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us","https://usn.ubuntu.com/3538-1/","https://www.exploit-db.com/exploits/40963/","https://www.openssh.com/txt/release-7.4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10009","description":"Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket."}]},{"artifact":{"id":"57604ba6c5c65d28","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-3ubuntu4.8:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/ubuntu/libxml2@2.9.1%2Bdfsg1-3ubuntu4.8?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.9.1+dfsg1-3ubuntu4.8","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-3ubuntu4.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3518","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3518","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3518","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3518","date":"2026-10-07","epss":0.21859,"percentile":0.97592}],"risk":10.9295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3518"},"relatedVulnerabilities":[{"id":"CVE-2021-3518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3518","cwe":"CWE-416","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3518","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3518","date":"2026-10-07","epss":0.21859,"percentile":0.97592}],"urls":["http://seclists.org/fulldisclosure/2021/Jul/54","http://seclists.org/fulldisclosure/2021/Jul/55","http://seclists.org/fulldisclosure/2021/Jul/58","http://seclists.org/fulldisclosure/2021/Jul/59","https://bugzilla.redhat.com/show_bug.cgi?id=1954242","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/","https://security.gentoo.org/glsa/202107-05","https://security.netapp.com/advisory/ntap-20210625-0002/","https://support.apple.com/kb/HT212601","https://support.apple.com/kb/HT212602","https://support.apple.com/kb/HT212604","https://support.apple.com/kb/HT212605","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3518","description":"There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability."}]},{"artifact":{"id":"8f1c215749686bf0","cpes":["cpe:2.3:a:apt:apt:1.0.1ubuntu2.14:*:*:*:*:*:*:*"],"name":"apt","purl":"pkg:deb/ubuntu/apt@1.0.1ubuntu2.14?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1ubuntu2.14","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/apt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt.list"},{"path":"/var/lib/dpkg/info/apt.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt.postinst"},{"path":"/var/lib/dpkg/info/apt.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt.postrm"},{"path":"/var/lib/dpkg/info/apt.shlibs","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt.shlibs"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.1ubuntu2.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.14"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.1ubuntu2.19"],"available":[{"date":"2019-01-22","kind":"advisory","version":"1.0.1ubuntu2.19"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-07","epss":0.14555,"percentile":0.96565}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-07","epss":0.14555,"percentile":0.96565}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"1112ff219ad241d3","cpes":["cpe:2.3:a:apt-transport-https:apt-transport-https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt-transport-https:apt_transport_https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt_transport_https:apt-transport-https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt_transport_https:apt_transport_https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt-transport:apt-transport-https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt-transport:apt_transport_https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt_transport:apt-transport-https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt_transport:apt_transport_https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt:apt-transport-https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt:apt_transport_https:1.0.1ubuntu2.14:*:*:*:*:*:*:*"],"name":"apt-transport-https","purl":"pkg:deb/ubuntu/apt-transport-https@1.0.1ubuntu2.14?arch=amd64&distro=ubuntu-14.04&upstream=apt","type":"deb","version":"1.0.1ubuntu2.14","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt-transport-https/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/apt-transport-https/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt-transport-https.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt-transport-https.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt-transport-https.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt-transport-https.list"}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.1ubuntu2.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.14"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.1ubuntu2.19"],"available":[{"date":"2019-01-22","kind":"advisory","version":"1.0.1ubuntu2.19"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-07","epss":0.14555,"percentile":0.96565}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-07","epss":0.14555,"percentile":0.96565}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"9fe37a2b70adefe3","cpes":["cpe:2.3:a:apt-utils:apt-utils:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt-utils:apt_utils:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt_utils:apt-utils:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt_utils:apt_utils:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt:apt-utils:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt:apt_utils:1.0.1ubuntu2.14:*:*:*:*:*:*:*"],"name":"apt-utils","purl":"pkg:deb/ubuntu/apt-utils@1.0.1ubuntu2.14?arch=amd64&distro=ubuntu-14.04&upstream=apt","type":"deb","version":"1.0.1ubuntu2.14","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt-utils/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/apt-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt-utils.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt-utils.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt-utils.list"}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.1ubuntu2.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.14"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.1ubuntu2.19"],"available":[{"date":"2019-01-22","kind":"advisory","version":"1.0.1ubuntu2.19"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-07","epss":0.14555,"percentile":0.96565}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-07","epss":0.14555,"percentile":0.96565}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"23ab47d4e03730e8","cpes":["cpe:2.3:a:libapt-inst1.5:libapt-inst1.5:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt-inst1.5:libapt_inst1.5:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt_inst1.5:libapt-inst1.5:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt_inst1.5:libapt_inst1.5:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-inst1.5:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_inst1.5:1.0.1ubuntu2.14:*:*:*:*:*:*:*"],"name":"libapt-inst1.5","purl":"pkg:deb/ubuntu/libapt-inst1.5@1.0.1ubuntu2.14?arch=amd64&distro=ubuntu-14.04&upstream=apt","type":"deb","version":"1.0.1ubuntu2.14","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-inst1.5/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libapt-inst1.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-inst1.5:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libapt-inst1.5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.1ubuntu2.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.14"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.1ubuntu2.19"],"available":[{"date":"2019-01-22","kind":"advisory","version":"1.0.1ubuntu2.19"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-07","epss":0.14555,"percentile":0.96565}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-07","epss":0.14555,"percentile":0.96565}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"2ba1e871639e4832","cpes":["cpe:2.3:a:libapt-pkg4.12:libapt-pkg4.12:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt-pkg4.12:libapt_pkg4.12:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt-pkg4.12:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt_pkg4.12:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-pkg4.12:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_pkg4.12:1.0.1ubuntu2.14:*:*:*:*:*:*:*"],"name":"libapt-pkg4.12","purl":"pkg:deb/ubuntu/libapt-pkg4.12@1.0.1ubuntu2.14?arch=amd64&distro=ubuntu-14.04&upstream=apt","type":"deb","version":"1.0.1ubuntu2.14","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-pkg4.12/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libapt-pkg4.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-3462","versionConstraint":"< 1.0.1ubuntu2.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.14"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-3462","fix":{"state":"fixed","versions":["1.0.1ubuntu2.19"],"available":[{"date":"2019-01-22","kind":"advisory","version":"1.0.1ubuntu2.19"}]},"cvss":[],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-07","epss":0.14555,"percentile":0.96565}],"risk":10.916250000000002,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-3462"},"relatedVulnerabilities":[{"id":"CVE-2019-3462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":9.3,"impactScore":10.1,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-3462","date":"2026-10-07","epss":0.14555,"percentile":0.96565}],"urls":["http://www.securityfocus.com/bid/106690","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/01/msg00013.html","https://lists.debian.org/debian-lts-announce/2019/01/msg00014.html","https://security.netapp.com/advisory/ntap-20190125-0002/","https://usn.ubuntu.com/3863-1/","https://usn.ubuntu.com/3863-2/","https://www.debian.org/security/2019/dsa-4371"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-3462","description":"Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-07","epss":0.20459,"percentile":0.97448}],"risk":10.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-24329"},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-07","epss":0.20459,"percentile":0.97448}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-07","epss":0.20459,"percentile":0.97448}],"risk":10.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-24329"},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-07","epss":0.20459,"percentile":0.97448}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-07","epss":0.20459,"percentile":0.97448}],"risk":10.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-24329"},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-07","epss":0.20459,"percentile":0.97448}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-24329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-24329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-07","epss":0.20459,"percentile":0.97448}],"risk":10.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-24329"},"relatedVulnerabilities":[{"id":"CVE-2023-24329","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-24329","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-24329","date":"2026-10-07","epss":0.20459,"percentile":0.97448}],"urls":["https://github.com/python/cpython/issues/102153","https://github.com/python/cpython/pull/99421","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/","https://pointernull.com/security/python-url-parse-problem.html","https://security.netapp.com/advisory/ntap-20230324-0004/","https://www.kb.cert.org/vuls/id/127587","https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-24329","description":"An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}]},{"artifact":{"id":"b81880fd126d2468","cpes":["cpe:2.3:a:isc-dhcp-client:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-client:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*"],"name":"isc-dhcp-client","purl":"pkg:deb/ubuntu/isc-dhcp-client@4.2.4-7ubuntu12.4?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.4","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/isc-dhcp-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.list"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postinst"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postrm"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.preinst"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.4-7ubuntu12.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5733","versionConstraint":"< 4.2.4-7ubuntu12.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-5733","fix":{"state":"fixed","versions":["4.2.4-7ubuntu12.12"],"available":[{"date":"2018-03-01","kind":"advisory","version":"4.2.4-7ubuntu12.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5733","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5733","date":"2026-10-07","epss":0.20242,"percentile":0.97411}],"risk":10.120999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-5733"},"relatedVulnerabilities":[{"id":"CVE-2018-5733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5733","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5733","date":"2026-10-07","epss":0.20242,"percentile":0.97411}],"urls":["http://www.securityfocus.com/bid/103188","http://www.securitytracker.com/id/1040437","https://access.redhat.com/errata/RHSA-2018:0469","https://access.redhat.com/errata/RHSA-2018:0483","https://kb.isc.org/docs/aa-01567","https://lists.debian.org/debian-lts-announce/2018/03/msg00015.html","https://usn.ubuntu.com/3586-1/","https://usn.ubuntu.com/3586-2/","https://www.debian.org/security/2018/dsa-4133","https://security.netapp.com/advisory/ntap-20250425-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5733","description":"A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0."}]},{"artifact":{"id":"c0a53a3f1b3af4cc","cpes":["cpe:2.3:a:isc-dhcp-common:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-common:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*"],"name":"isc-dhcp-common","purl":"pkg:deb/ubuntu/isc-dhcp-common@4.2.4-7ubuntu12.4?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.4","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-common/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/isc-dhcp-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.list"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"fix":{"suggestedVersion":"4.2.4-7ubuntu12.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-5733","versionConstraint":"< 4.2.4-7ubuntu12.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-5733","fix":{"state":"fixed","versions":["4.2.4-7ubuntu12.12"],"available":[{"date":"2018-03-01","kind":"advisory","version":"4.2.4-7ubuntu12.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-5733","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5733","date":"2026-10-07","epss":0.20242,"percentile":0.97411}],"risk":10.120999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-5733"},"relatedVulnerabilities":[{"id":"CVE-2018-5733","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-5733","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-5733","date":"2026-10-07","epss":0.20242,"percentile":0.97411}],"urls":["http://www.securityfocus.com/bid/103188","http://www.securitytracker.com/id/1040437","https://access.redhat.com/errata/RHSA-2018:0469","https://access.redhat.com/errata/RHSA-2018:0483","https://kb.isc.org/docs/aa-01567","https://lists.debian.org/debian-lts-announce/2018/03/msg00015.html","https://usn.ubuntu.com/3586-1/","https://usn.ubuntu.com/3586-2/","https://www.debian.org/security/2018/dsa-4133","https://security.netapp.com/advisory/ntap-20250425-0010/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-5733","description":"A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 32-bit reference counter, potentially causing dhcpd to crash. Affects ISC DHCP 4.1.0 -> 4.1-ESV-R15, 4.2.0 -> 4.2.8, 4.3.0 -> 4.3.6, 4.4.0."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000802","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-10-07","epss":0.20126,"percentile":0.97398}],"risk":10.062999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000802"},"relatedVulnerabilities":[{"id":"CVE-2018-1000802","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-10-07","epss":0.20126,"percentile":0.97398}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000802","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-10-07","epss":0.20126,"percentile":0.97398}],"risk":10.062999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000802"},"relatedVulnerabilities":[{"id":"CVE-2018-1000802","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-10-07","epss":0.20126,"percentile":0.97398}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000802","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-10-07","epss":0.20126,"percentile":0.97398}],"risk":10.062999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000802"},"relatedVulnerabilities":[{"id":"CVE-2018-1000802","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-10-07","epss":0.20126,"percentile":0.97398}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000802","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000802","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-10-07","epss":0.20126,"percentile":0.97398}],"risk":10.062999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000802"},"relatedVulnerabilities":[{"id":"CVE-2018-1000802","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000802","cwe":"CWE-77","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000802","date":"2026-10-07","epss":0.20126,"percentile":0.97398}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://bugs.python.org/issue34540","https://github.com/python/cpython/pull/8985","https://github.com/python/cpython/pull/8985/commits/add531a1e55b0a739b0f42582f1c9747e5649ace","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://mega.nz/#%21JUFiCC4R%21mq-jQ8ySFwIhX6WMDujaZuNBfttDVt7DETlfOIQE1ig","https://security.netapp.com/advisory/ntap-20230309-0002/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000802","description":"Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in shutil module (make_archive function) that can result in Denial of service, Information gain via injection of arbitrary files on the system or entire drive. This attack appear to be exploitable via Passage of unfiltered user input to the function. This vulnerability appears to have been fixed in after commit add531a1e55b0a739b0f42582f1c9747e5649ace."}]},{"artifact":{"id":"0cce56105b872ee0","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.19-0ubuntu6.9?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.9","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-0ubuntu6.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"< 2.19-0ubuntu6.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.9"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"fixed","versions":["2.19-0ubuntu6.14"],"available":[{"date":"2018-01-17","kind":"advisory","version":"2.19-0ubuntu6.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-07","epss":0.13368,"percentile":0.96325}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-07","epss":0.13368,"percentile":0.96325}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"2a99d1b0f32aebfa","cpes":["cpe:2.3:a:libc6:libc6:2.19-0ubuntu6.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.19-0ubuntu6.9?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.9","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-0ubuntu6.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"< 2.19-0ubuntu6.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.9"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"fixed","versions":["2.19-0ubuntu6.14"],"available":[{"date":"2018-01-17","kind":"advisory","version":"2.19-0ubuntu6.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-07","epss":0.13368,"percentile":0.96325}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-07","epss":0.13368,"percentile":0.96325}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"63846d3755a29a0c","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-0ubuntu6.9:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/ubuntu/multiarch-support@2.19-0ubuntu6.9?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.9","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.19-0ubuntu6.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000001","versionConstraint":"< 2.19-0ubuntu6.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.9"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000001","fix":{"state":"fixed","versions":["2.19-0ubuntu6.14"],"available":[{"date":"2018-01-17","kind":"advisory","version":"2.19-0ubuntu6.14"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-07","epss":0.13368,"percentile":0.96325}],"risk":10.025999999999998,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000001"},"relatedVulnerabilities":[{"id":"CVE-2018-1000001","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":7.2,"impactScore":10.1,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000001","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000001","date":"2026-10-07","epss":0.13368,"percentile":0.96325}],"urls":["http://seclists.org/oss-sec/2018/q1/38","http://www.securityfocus.com/bid/102525","http://www.securitytracker.com/id/1040162","https://access.redhat.com/errata/RHSA-2018:0805","https://security.netapp.com/advisory/ntap-20190404-0003/","https://usn.ubuntu.com/3534-1/","https://usn.ubuntu.com/3536-1/","https://www.exploit-db.com/exploits/43775/","https://www.exploit-db.com/exploits/44889/","https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000001","description":"In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution."}]},{"artifact":{"id":"3695a31b2933dc8f","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-51385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-51385","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-51385","date":"2026-10-07","epss":0.19753,"percentile":0.97344}],"risk":9.8765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-51385"},"relatedVulnerabilities":[{"id":"CVE-2023-51385","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-51385","date":"2026-10-07","epss":0.19753,"percentile":0.97344}],"urls":["http://seclists.org/fulldisclosure/2024/Mar/21","http://www.openwall.com/lists/oss-security/2023/12/26/4","https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a","https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","https://security.gentoo.org/glsa/202312-17","https://security.netapp.com/advisory/ntap-20240105-0005/","https://support.apple.com/kb/HT214084","https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html","https://www.debian.org/security/2023/dsa-5586","https://www.openssh.com/txt/release-9.6","https://www.openwall.com/lists/oss-security/2023/12/18/2","http://www.openwall.com/lists/oss-security/2025/10/07/1","http://www.openwall.com/lists/oss-security/2025/10/12/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-51385","description":"In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name."}]},{"artifact":{"id":"54d7c6e40533c708","cpes":["cpe:2.3:a:openssh-server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-server","purl":"pkg:deb/ubuntu/openssh-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.config","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.config"},{"path":"/var/lib/dpkg/info/openssh-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.list"},{"path":"/var/lib/dpkg/info/openssh-server.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postinst"},{"path":"/var/lib/dpkg/info/openssh-server.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postrm"},{"path":"/var/lib/dpkg/info/openssh-server.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.preinst"},{"path":"/var/lib/dpkg/info/openssh-server.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.prerm"},{"path":"/var/lib/dpkg/info/openssh-server.templates","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.templates"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-51385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-51385","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-51385","date":"2026-10-07","epss":0.19753,"percentile":0.97344}],"risk":9.8765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-51385"},"relatedVulnerabilities":[{"id":"CVE-2023-51385","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-51385","date":"2026-10-07","epss":0.19753,"percentile":0.97344}],"urls":["http://seclists.org/fulldisclosure/2024/Mar/21","http://www.openwall.com/lists/oss-security/2023/12/26/4","https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a","https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","https://security.gentoo.org/glsa/202312-17","https://security.netapp.com/advisory/ntap-20240105-0005/","https://support.apple.com/kb/HT214084","https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html","https://www.debian.org/security/2023/dsa-5586","https://www.openssh.com/txt/release-9.6","https://www.openwall.com/lists/oss-security/2023/12/18/2","http://www.openwall.com/lists/oss-security/2025/10/07/1","http://www.openwall.com/lists/oss-security/2025/10/12/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-51385","description":"In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name."}]},{"artifact":{"id":"b3db4be88de03e2f","cpes":["cpe:2.3:a:openssh-sftp-server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp-server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-sftp-server","purl":"pkg:deb/ubuntu/openssh-sftp-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-sftp-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.list"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-51385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2023-51385","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-51385","date":"2026-10-07","epss":0.19753,"percentile":0.97344}],"risk":9.8765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-51385"},"relatedVulnerabilities":[{"id":"CVE-2023-51385","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-51385","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-51385","date":"2026-10-07","epss":0.19753,"percentile":0.97344}],"urls":["http://seclists.org/fulldisclosure/2024/Mar/21","http://www.openwall.com/lists/oss-security/2023/12/26/4","https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a","https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html","https://security.gentoo.org/glsa/202312-17","https://security.netapp.com/advisory/ntap-20240105-0005/","https://support.apple.com/kb/HT214084","https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html","https://www.debian.org/security/2023/dsa-5586","https://www.openssh.com/txt/release-9.6","https://www.openwall.com/lists/oss-security/2023/12/18/2","http://www.openwall.com/lists/oss-security/2025/10/07/1","http://www.openwall.com/lists/oss-security/2025/10/12/1","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-769027.html","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-51385","description":"In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name."}]},{"artifact":{"id":"a9e4b54eee4ab8e5","cpes":["cpe:2.3:a:klibc-utils:klibc-utils:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:klibc-utils:klibc_utils:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:klibc_utils:klibc-utils:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:klibc_utils:klibc_utils:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:klibc:klibc-utils:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:klibc:klibc_utils:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"klibc-utils","purl":"pkg:deb/ubuntu/klibc-utils@2.0.3-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=klibc","type":"deb","version":"2.0.3-0ubuntu1.14.04.1","language":"","licenses":["sha256:d0f580bd7629b15b6bb1b36468b51182545a8002612a030fca39fec2e3203707"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libklibc/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/klibc-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/klibc-utils.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/klibc-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/klibc-utils.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/klibc-utils.list"},{"path":"/var/lib/dpkg/info/klibc-utils.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/klibc-utils.postinst"}],"upstreams":[{"name":"klibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-37434","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"klibc","version":"2.0.3-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-37434","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-10-07","epss":0.18972,"percentile":0.97236}],"risk":9.486,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-37434"},"relatedVulnerabilities":[{"id":"CVE-2022-37434","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-10-07","epss":0.18972,"percentile":0.97236}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/37","http://seclists.org/fulldisclosure/2022/Oct/38","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/42","http://www.openwall.com/lists/oss-security/2022/08/05/2","http://www.openwall.com/lists/oss-security/2022/08/09/1","https://github.com/curl/curl/issues/9271","https://github.com/ivd38/zlib_overflow","https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063","https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d","https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1","https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764","https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/","https://security.netapp.com/advisory/ntap-20220901-0005/","https://security.netapp.com/advisory/ntap-20230427-0007/","https://support.apple.com/kb/HT213488","https://support.apple.com/kb/HT213489","https://support.apple.com/kb/HT213490","https://support.apple.com/kb/HT213491","https://support.apple.com/kb/HT213493","https://support.apple.com/kb/HT213494","https://www.debian.org/security/2022/dsa-5218","https://cert-portal.siemens.com/productcert/html/ssa-150063.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37434","description":"zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference)."}]},{"artifact":{"id":"746a569619b5b5e0","cpes":["cpe:2.3:a:libklibc:libklibc:2.0.3-0ubuntu1.14.04.1:*:*:*:*:*:*:*"],"name":"libklibc","purl":"pkg:deb/ubuntu/libklibc@2.0.3-0ubuntu1.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=klibc","type":"deb","version":"2.0.3-0ubuntu1.14.04.1","language":"","licenses":["sha256:d0f580bd7629b15b6bb1b36468b51182545a8002612a030fca39fec2e3203707"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libklibc/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libklibc/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libklibc.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libklibc.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libklibc.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libklibc.list"}],"upstreams":[{"name":"klibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-37434","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"klibc","version":"2.0.3-0ubuntu1.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-37434","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-10-07","epss":0.18972,"percentile":0.97236}],"risk":9.486,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-37434"},"relatedVulnerabilities":[{"id":"CVE-2022-37434","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-10-07","epss":0.18972,"percentile":0.97236}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/37","http://seclists.org/fulldisclosure/2022/Oct/38","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/42","http://www.openwall.com/lists/oss-security/2022/08/05/2","http://www.openwall.com/lists/oss-security/2022/08/09/1","https://github.com/curl/curl/issues/9271","https://github.com/ivd38/zlib_overflow","https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063","https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d","https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1","https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764","https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/","https://security.netapp.com/advisory/ntap-20220901-0005/","https://security.netapp.com/advisory/ntap-20230427-0007/","https://support.apple.com/kb/HT213488","https://support.apple.com/kb/HT213489","https://support.apple.com/kb/HT213490","https://support.apple.com/kb/HT213491","https://support.apple.com/kb/HT213493","https://support.apple.com/kb/HT213494","https://www.debian.org/security/2022/dsa-5218","https://cert-portal.siemens.com/productcert/html/ssa-150063.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37434","description":"zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference)."}]},{"artifact":{"id":"a1d1894adfb63c2e","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.2.8.dfsg-1ubuntu1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/ubuntu/zlib1g@1%3A1.2.8.dfsg-1ubuntu1?arch=amd64&distro=ubuntu-14.04&upstream=zlib","type":"deb","version":"1:1.2.8.dfsg-1ubuntu1","language":"","licenses":["sha256:bcf07f8f2414e28405b35fee95fb14569e926a7d4e99cc4a5db2fe1a0d1aca56"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-37434","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"zlib","version":"1:1.2.8.dfsg-1ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-37434","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-10-07","epss":0.18972,"percentile":0.97236}],"risk":9.486,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-37434"},"relatedVulnerabilities":[{"id":"CVE-2022-37434","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-37434","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-37434","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-37434","date":"2026-10-07","epss":0.18972,"percentile":0.97236}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/37","http://seclists.org/fulldisclosure/2022/Oct/38","http://seclists.org/fulldisclosure/2022/Oct/41","http://seclists.org/fulldisclosure/2022/Oct/42","http://www.openwall.com/lists/oss-security/2022/08/05/2","http://www.openwall.com/lists/oss-security/2022/08/09/1","https://github.com/curl/curl/issues/9271","https://github.com/ivd38/zlib_overflow","https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063","https://github.com/madler/zlib/commit/1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d","https://github.com/madler/zlib/commit/eff308af425b67093bab25f80f1ae950166bece1","https://github.com/nodejs/node/blob/75b68c6e4db515f76df73af476eccf382bbcb00a/deps/zlib/inflate.c#L762-L764","https://lists.debian.org/debian-lts-announce/2022/09/msg00012.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWN4VE3JQR4O2SOUS5TXNLANRPMHWV4I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NMBOJ77A7T7PQCARMDUK75TE6LLESZ3O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAVPQNCG3XRLCLNSQRM3KAN5ZFMVXVTY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5U7OTKZSHY2I3ZFJSR2SHFHW72RKGDK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRQAI7H4M4RQZ2IWZUEEXECBE5D56BH2/","https://security.netapp.com/advisory/ntap-20220901-0005/","https://security.netapp.com/advisory/ntap-20230427-0007/","https://support.apple.com/kb/HT213488","https://support.apple.com/kb/HT213489","https://support.apple.com/kb/HT213490","https://support.apple.com/kb/HT213491","https://support.apple.com/kb/HT213493","https://support.apple.com/kb/HT213494","https://www.debian.org/security/2022/dsa-5218","https://cert-portal.siemens.com/productcert/html/ssa-150063.html","https://cert-portal.siemens.com/productcert/html/ssa-202008.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-470355.html","https://cert-portal.siemens.com/productcert/html/ssa-561322.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-37434","description":"zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference)."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.24"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0739","versionConstraint":"< 1.0.1f-1ubuntu2.24 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0739","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.24"],"available":[{"date":"2018-03-28","kind":"advisory","version":"1.0.1f-1ubuntu2.24"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-07","epss":0.18596,"percentile":0.97192}],"risk":9.298,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0739"},"relatedVulnerabilities":[{"id":"CVE-2018-0739","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-07","epss":0.18596,"percentile":0.97192}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103518","http://www.securityfocus.com/bid/105609","http://www.securitytracker.com/id/1040576","https://access.redhat.com/errata/RHSA-2018:3090","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:0366","https://access.redhat.com/errata/RHSA-2019:0367","https://access.redhat.com/errata/RHSA-2019:1711","https://access.redhat.com/errata/RHSA-2019:1712","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d","https://lists.debian.org/debian-lts-announce/2018/03/msg00033.html","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.gentoo.org/glsa/202007-53","https://security.netapp.com/advisory/ntap-20180330-0002/","https://security.netapp.com/advisory/ntap-20180726-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3611-1/","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2018/dsa-4157","https://www.debian.org/security/2018/dsa-4158","https://www.openssl.org/news/secadv/20180327.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-04","https://www.tenable.com/security/tns-2018-06","https://www.tenable.com/security/tns-2018-07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0739","description":"Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.24"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0739","versionConstraint":"< 1.0.1f-1ubuntu2.24 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0739","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.24"],"available":[{"date":"2018-03-28","kind":"advisory","version":"1.0.1f-1ubuntu2.24"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-07","epss":0.18596,"percentile":0.97192}],"risk":9.298,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0739"},"relatedVulnerabilities":[{"id":"CVE-2018-0739","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0739","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0739","date":"2026-10-07","epss":0.18596,"percentile":0.97192}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103518","http://www.securityfocus.com/bid/105609","http://www.securitytracker.com/id/1040576","https://access.redhat.com/errata/RHSA-2018:3090","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:0366","https://access.redhat.com/errata/RHSA-2019:0367","https://access.redhat.com/errata/RHSA-2019:1711","https://access.redhat.com/errata/RHSA-2019:1712","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d","https://lists.debian.org/debian-lts-announce/2018/03/msg00033.html","https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.gentoo.org/glsa/202007-53","https://security.netapp.com/advisory/ntap-20180330-0002/","https://security.netapp.com/advisory/ntap-20180726-0002/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3611-1/","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2018/dsa-4157","https://www.debian.org/security/2018/dsa-4158","https://www.openssl.org/news/secadv/20180327.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-04","https://www.tenable.com/security/tns-2018-06","https://www.tenable.com/security/tns-2018-07"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0739","description":"Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n)."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2180","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2180","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2180","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2180","date":"2026-10-07","epss":0.29982,"percentile":0.9817}],"risk":8.994599999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2180"},"relatedVulnerabilities":[{"id":"CVE-2016-2180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2180","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2180","date":"2026-10-07","epss":0.29982,"percentile":0.9817}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92117","http://www.securitytracker.com/id/1036486","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1359615","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/0ed26acce328ec16a3aa635f1ca37365e8c7403a","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2180","description":"The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the \"openssl ts\" command."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2180","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2180","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2180","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2180","date":"2026-10-07","epss":0.29982,"percentile":0.9817}],"risk":8.994599999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2180"},"relatedVulnerabilities":[{"id":"CVE-2016-2180","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2180","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2180","date":"2026-10-07","epss":0.29982,"percentile":0.9817}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92117","http://www.securitytracker.com/id/1036486","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bto.bluecoat.com/security-advisory/sa132","https://bugzilla.redhat.com/show_bug.cgi?id=1359615","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/0ed26acce328ec16a3aa635f1ca37365e8c7403a","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://security.gentoo.org/glsa/201612-16","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2180","description":"The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the \"openssl ts\" command."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-5482","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5482","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-07","epss":0.17939,"percentile":0.97113}],"risk":8.9695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5482"},"relatedVulnerabilities":[{"id":"CVE-2019-5482","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-07","epss":0.17939,"percentile":0.97113}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5482.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://security.netapp.com/advisory/ntap-20200416-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5482","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5482","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-07","epss":0.17939,"percentile":0.97113}],"risk":8.9695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5482"},"relatedVulnerabilities":[{"id":"CVE-2019-5482","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-07","epss":0.17939,"percentile":0.97113}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5482.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://security.netapp.com/advisory/ntap-20200416-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5482","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5482","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-07","epss":0.17939,"percentile":0.97113}],"risk":8.9695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5482"},"relatedVulnerabilities":[{"id":"CVE-2019-5482","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5482","cwe":"CWE-122","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2019-5482","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5482","date":"2026-10-07","epss":0.17939,"percentile":0.97113}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00055.html","https://curl.haxx.se/docs/CVE-2019-5482.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CI4QQ2RSZX4VCFM76SIWGKY6BY7UWIC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGDVKSLY5JUNJRLYRUA6CXGQ2LM63XC3/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UA7KDM2WPM5CJDDGOEGFV6SSGD2J7RNT/","https://seclists.org/bugtraq/2020/Feb/36","https://security.gentoo.org/glsa/202003-29","https://security.netapp.com/advisory/ntap-20191004-0003/","https://security.netapp.com/advisory/ntap-20200416-0003/","https://www.debian.org/security/2020/dsa-4633","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5482","description":"Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3."}]},{"artifact":{"id":"6a80592ef3ca2b96","cpes":["cpe:2.3:a:libxslt1.1:libxslt1.1:1.1.28-2build1:*:*:*:*:*:*:*"],"name":"libxslt1.1","purl":"pkg:deb/ubuntu/libxslt1.1@1.1.28-2build1?arch=amd64&distro=ubuntu-14.04&upstream=libxslt","type":"deb","version":"1.1.28-2build1","language":"","licenses":["sha256:4b82c8dd6e55001a5921bea1d6db20be5c51e5976d892e870324026c23f37b6f"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxslt1.1/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libxslt1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libxslt1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libxslt"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-30560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxslt","version":"1.1.28-2build1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-30560","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-30560","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-30560","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-30560","date":"2026-10-07","epss":0.17634,"percentile":0.97081}],"risk":8.817,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-30560"},"relatedVulnerabilities":[{"id":"CVE-2021-30560","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-30560","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-30560","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-30560","date":"2026-10-07","epss":0.17634,"percentile":0.97081}],"urls":["https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop.html","https://crbug.com/1219209","https://lists.debian.org/debian-lts-announce/2022/09/msg00010.html","https://security.gentoo.org/glsa/202310-23","https://www.debian.org/security/2022/dsa-5216"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-30560","description":"Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-07","epss":0.17301,"percentile":0.97038}],"risk":8.6505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7264"},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-07","epss":0.17301,"percentile":0.97038}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-07","epss":0.17301,"percentile":0.97038}],"risk":8.6505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7264"},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-07","epss":0.17301,"percentile":0.97038}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7264","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-7264","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-07","epss":0.17301,"percentile":0.97038}],"risk":8.6505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7264"},"relatedVulnerabilities":[{"id":"CVE-2024-7264","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7264","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-7264","date":"2026-10-07","epss":0.17301,"percentile":0.97038}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/31/1","https://curl.se/docs/CVE-2024-7264.html","https://curl.se/docs/CVE-2024-7264.json","https://hackerone.com/reports/2629968","https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519","https://security.netapp.com/advisory/ntap-20240828-0008/","https://security.netapp.com/advisory/ntap-20241025-0006/","https://security.netapp.com/advisory/ntap-20241025-0010/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7264","description":"libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1559","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-07","epss":0.17139,"percentile":0.97017}],"risk":8.5695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1559"},"relatedVulnerabilities":[{"id":"CVE-2019-1559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-07","epss":0.17139,"percentile":0.97017}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html","http://www.securityfocus.com/bid/107174","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:2437","https://access.redhat.com/errata/RHSA-2019:2439","https://access.redhat.com/errata/RHSA-2019:2471","https://access.redhat.com/errata/RHSA-2019:3929","https://access.redhat.com/errata/RHSA-2019:3931","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e","https://kc.mcafee.com/corporate/index?page=content&id=SB10282","https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://security.gentoo.org/glsa/201903-10","https://security.netapp.com/advisory/ntap-20190301-0001/","https://security.netapp.com/advisory/ntap-20190301-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://support.f5.com/csp/article/K18549143","https://support.f5.com/csp/article/K18549143?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3899-1/","https://usn.ubuntu.com/4376-2/","https://www.debian.org/security/2019/dsa-4400","https://www.openssl.org/news/secadv/20190226.txt","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-02","https://www.tenable.com/security/tns-2019-03"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1559","description":"If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-1559","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-1559","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-07","epss":0.17139,"percentile":0.97017}],"risk":8.5695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1559"},"relatedVulnerabilities":[{"id":"CVE-2019-1559","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1559","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1559","date":"2026-10-07","epss":0.17139,"percentile":0.97017}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00041.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00046.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00047.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00049.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00080.html","http://www.securityfocus.com/bid/107174","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:2437","https://access.redhat.com/errata/RHSA-2019:2439","https://access.redhat.com/errata/RHSA-2019:2471","https://access.redhat.com/errata/RHSA-2019:3929","https://access.redhat.com/errata/RHSA-2019:3931","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e","https://kc.mcafee.com/corporate/index?page=content&id=SB10282","https://lists.debian.org/debian-lts-announce/2019/03/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://security.gentoo.org/glsa/201903-10","https://security.netapp.com/advisory/ntap-20190301-0001/","https://security.netapp.com/advisory/ntap-20190301-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://support.f5.com/csp/article/K18549143","https://support.f5.com/csp/article/K18549143?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3899-1/","https://usn.ubuntu.com/4376-2/","https://www.debian.org/security/2019/dsa-4400","https://www.openssl.org/news/secadv/20190226.txt","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.tenable.com/security/tns-2019-02","https://www.tenable.com/security/tns-2019-03"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1559","description":"If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q)."}]},{"artifact":{"id":"57604ba6c5c65d28","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-3ubuntu4.8:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/ubuntu/libxml2@2.9.1%2Bdfsg1-3ubuntu4.8?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.9.1+dfsg1-3ubuntu4.8","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3517","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-3ubuntu4.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3517","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3517","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3517","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3517","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3517","date":"2026-10-07","epss":0.16986,"percentile":0.96997}],"risk":8.493,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3517"},"relatedVulnerabilities":[{"id":"CVE-2021-3517","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":8.6,"impactScore":4.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3517","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3517","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3517","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-3517","date":"2026-10-07","epss":0.16986,"percentile":0.96997}],"urls":["https://bugzilla.redhat.com/show_bug.cgi?id=1954232","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/","https://security.gentoo.org/glsa/202107-05","https://security.netapp.com/advisory/ntap-20210625-0002/","https://security.netapp.com/advisory/ntap-20211022-0004/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3517","description":"There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6302","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6302","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6302","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6302","date":"2026-10-07","epss":0.27806,"percentile":0.9805}],"risk":8.3418,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6302"},"relatedVulnerabilities":[{"id":"CVE-2016-6302","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6302","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6302","date":"2026-10-07","epss":0.27806,"percentile":0.9805}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92628","http://www.securitytracker.com/id/1036885","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=e97763c92c655dcf4af2860b3abd2bc4c8a267f9","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6302","description":"The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6302","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6302","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6302","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6302","date":"2026-10-07","epss":0.27806,"percentile":0.9805}],"risk":8.3418,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6302"},"relatedVulnerabilities":[{"id":"CVE-2016-6302","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6302","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6302","date":"2026-10-07","epss":0.27806,"percentile":0.9805}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92628","http://www.securitytracker.com/id/1036885","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://access.redhat.com/errata/RHSA-2018:2185","https://access.redhat.com/errata/RHSA-2018:2186","https://access.redhat.com/errata/RHSA-2018:2187","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=e97763c92c655dcf4af2860b3abd2bc4c8a267f9","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6302","description":"The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short."}]},{"artifact":{"id":"b37dbcb586168da6","cpes":["cpe:2.3:a:busybox-initramfs:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox-initramfs:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox_initramfs:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox_initramfs:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*"],"name":"busybox-initramfs","purl":"pkg:deb/ubuntu/busybox-initramfs@1%3A1.21.0-1ubuntu1?arch=amd64&distro=ubuntu-14.04&upstream=busybox","type":"deb","version":"1:1.21.0-1ubuntu1","language":"","licenses":["sha256:336d995e819d3a7a3fdbf3f5041c07094f75ee849acb3bb742b7503d45786329"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/busybox-initramfs/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/busybox-initramfs/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/busybox-initramfs.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/busybox-initramfs.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/busybox-initramfs.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/busybox-initramfs.list"}],"upstreams":[{"name":"busybox"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.21.0-1ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2148","versionConstraint":"< 1:1.21.0-1ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"busybox","version":"1:1.21.0-1ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2148","fix":{"state":"fixed","versions":["1:1.21.0-1ubuntu1.4"],"available":[{"date":"2019-04-03","kind":"advisory","version":"1:1.21.0-1ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2148","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2148","date":"2026-10-07","epss":0.27111,"percentile":0.98006}],"risk":8.1333,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2148"},"relatedVulnerabilities":[{"id":"CVE-2016-2148","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2148","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2148","date":"2026-10-07","epss":0.27111,"percentile":0.98006}],"urls":["http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html","http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://seclists.org/fulldisclosure/2020/Aug/20","http://www.openwall.com/lists/oss-security/2016/03/11/16","https://busybox.net/news.html","https://git.busybox.net/busybox/commit/?id=352f79acbd759c14399e39baef21fc4ffe180ac2","https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html","https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://security.gentoo.org/glsa/201612-04","https://usn.ubuntu.com/3935-1/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2148","description":"Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-4304","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-4304","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-10-07","epss":0.16195,"percentile":0.96862}],"risk":8.0975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-4304"},"relatedVulnerabilities":[{"id":"CVE-2022-4304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-10-07","epss":0.16195,"percentile":0.96862}],"urls":["https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4304","description":"A timing based side channel exists in the OpenSSL RSA Decryption implementation\nwhich could be sufficient to recover a plaintext across a network in a\nBleichenbacher style attack. To achieve a successful decryption an attacker\nwould have to be able to send a very large number of trial messages for\ndecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,\nRSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an\nencrypted pre-master secret to the server. An attacker that had observed a\ngenuine connection between a client and a server could use this flaw to send\ntrial messages to the server and record the time taken to process them. After a\nsufficiently large number of messages the attacker could recover the pre-master\nsecret used for the original connection and thus be able to decrypt the\napplication data sent over that connection."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-4304","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-4304","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-10-07","epss":0.16195,"percentile":0.96862}],"risk":8.0975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-4304"},"relatedVulnerabilities":[{"id":"CVE-2022-4304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-4304","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-4304","date":"2026-10-07","epss":0.16195,"percentile":0.96862}],"urls":["https://security.gentoo.org/glsa/202402-08","https://www.openssl.org/news/secadv/20230207.txt","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0003"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-4304","description":"A timing based side channel exists in the OpenSSL RSA Decryption implementation\nwhich could be sufficient to recover a plaintext across a network in a\nBleichenbacher style attack. To achieve a successful decryption an attacker\nwould have to be able to send a very large number of trial messages for\ndecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,\nRSA-OEAP and RSASVE.\n\nFor example, in a TLS connection, RSA is commonly used by a client to send an\nencrypted pre-master secret to the server. An attacker that had observed a\ngenuine connection between a client and a server could use this flaw to send\ntrial messages to the server and record the time taken to process them. After a\nsufficiently large number of messages the attacker could recover the pre-master\nsecret used for the original connection and thus be able to decrypt the\napplication data sent over that connection."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2179","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2179","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2179","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2179","date":"2026-10-07","epss":0.26559,"percentile":0.9797}],"risk":7.9677,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2179"},"relatedVulnerabilities":[{"id":"CVE-2016-2179","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2179","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2179","date":"2026-10-07","epss":0.26559,"percentile":0.9797}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92987","http://www.securitytracker.com/id/1036689","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5c7f5dfbaf0d2f7d946d0fe86f08e6bcb36ed0d","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2179","description":"The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2179","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2179","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2179","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2179","date":"2026-10-07","epss":0.26559,"percentile":0.9797}],"risk":7.9677,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2179"},"relatedVulnerabilities":[{"id":"CVE-2016-2179","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2179","cwe":"CWE-399","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2179","date":"2026-10-07","epss":0.26559,"percentile":0.9797}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92987","http://www.securitytracker.com/id/1036689","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5c7f5dfbaf0d2f7d946d0fe86f08e6bcb36ed0d","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2179","description":"The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c."}]},{"artifact":{"id":"a61a2ea1a4466ff6","cpes":["cpe:2.3:a:tar:tar:1.27.1-1:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/ubuntu/tar@1.27.1-1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.27.1-1","language":"","licenses":["sha256:9292780f2dfd11900e92ea67c7a316cf9df740b955956f87ec099a5b4f3d9136"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.conffiles","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/tar.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.27.1-1ubuntu0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6321","versionConstraint":"< 1.27.1-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"tar","version":"1.27.1-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6321","fix":{"state":"fixed","versions":["1.27.1-1ubuntu0.1"],"available":[{"date":"2016-11-21","kind":"advisory","version":"1.27.1-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6321","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-6321","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-6321","date":"2026-10-07","epss":0.15745,"percentile":0.96784}],"risk":7.8725000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6321"},"relatedVulnerabilities":[{"id":"CVE-2016-6321","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6321","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-6321","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-6321","date":"2026-10-07","epss":0.15745,"percentile":0.96784}],"urls":["http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d","http://lists.gnu.org/archive/html/bug-tar/2016-10/msg00016.html","http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html","http://seclists.org/fulldisclosure/2016/Oct/102","http://seclists.org/fulldisclosure/2016/Oct/96","http://www.debian.org/security/2016/dsa-3702","http://www.securityfocus.com/bid/93937","http://www.ubuntu.com/usn/USN-3132-1","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201611-19","https://sintonen.fi/advisories/tar-extract-pathname-bypass.proper.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6321","description":"Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-5420","versionConstraint":"< 7.35.0-1ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5420","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.8"],"available":[{"date":"2016-08-08","kind":"advisory","version":"7.35.0-1ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5420","cwe":"CWE-285","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5420","date":"2026-10-07","epss":0.15362,"percentile":0.967}],"risk":7.681,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5420"},"relatedVulnerabilities":[{"id":"CVE-2016-5420","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5420","cwe":"CWE-285","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5420","date":"2026-10-07","epss":0.15362,"percentile":0.967}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92309","http://www.securitytracker.com/id/1036537","http://www.securitytracker.com/id/1036739","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803B.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5420","description":"curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5420","versionConstraint":"< 7.35.0-1ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5420","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.8"],"available":[{"date":"2016-08-08","kind":"advisory","version":"7.35.0-1ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5420","cwe":"CWE-285","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5420","date":"2026-10-07","epss":0.15362,"percentile":0.967}],"risk":7.681,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5420"},"relatedVulnerabilities":[{"id":"CVE-2016-5420","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5420","cwe":"CWE-285","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5420","date":"2026-10-07","epss":0.15362,"percentile":0.967}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92309","http://www.securitytracker.com/id/1036537","http://www.securitytracker.com/id/1036739","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803B.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5420","description":"curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5420","versionConstraint":"< 7.35.0-1ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5420","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.8"],"available":[{"date":"2016-08-08","kind":"advisory","version":"7.35.0-1ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5420","cwe":"CWE-285","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5420","date":"2026-10-07","epss":0.15362,"percentile":0.967}],"risk":7.681,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5420"},"relatedVulnerabilities":[{"id":"CVE-2016-5420","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5420","cwe":"CWE-285","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5420","date":"2026-10-07","epss":0.15362,"percentile":0.967}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92309","http://www.securitytracker.com/id/1036537","http://www.securitytracker.com/id/1036739","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803B.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5420","description":"curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-5419","versionConstraint":"< 7.35.0-1ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5419","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.8"],"available":[{"date":"2016-08-08","kind":"advisory","version":"7.35.0-1ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5419","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5419","date":"2026-10-07","epss":0.15063,"percentile":0.96648}],"risk":7.531499999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5419"},"relatedVulnerabilities":[{"id":"CVE-2016-5419","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5419","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5419","date":"2026-10-07","epss":0.15063,"percentile":0.96648}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92292","http://www.securityfocus.com/bid/92319","http://www.securitytracker.com/id/1036538","http://www.securitytracker.com/id/1038341","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803A.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5419","description":"curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5419","versionConstraint":"< 7.35.0-1ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5419","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.8"],"available":[{"date":"2016-08-08","kind":"advisory","version":"7.35.0-1ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5419","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5419","date":"2026-10-07","epss":0.15063,"percentile":0.96648}],"risk":7.531499999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5419"},"relatedVulnerabilities":[{"id":"CVE-2016-5419","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5419","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5419","date":"2026-10-07","epss":0.15063,"percentile":0.96648}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92292","http://www.securityfocus.com/bid/92319","http://www.securitytracker.com/id/1036538","http://www.securitytracker.com/id/1038341","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803A.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5419","description":"curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5419","versionConstraint":"< 7.35.0-1ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5419","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.8"],"available":[{"date":"2016-08-08","kind":"advisory","version":"7.35.0-1ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5419","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5419","date":"2026-10-07","epss":0.15063,"percentile":0.96648}],"risk":7.531499999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5419"},"relatedVulnerabilities":[{"id":"CVE-2016-5419","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5419","cwe":"CWE-310","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5419","date":"2026-10-07","epss":0.15063,"percentile":0.96648}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://rhn.redhat.com/errata/RHSA-2016-2575.html","http://rhn.redhat.com/errata/RHSA-2016-2957.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92292","http://www.securityfocus.com/bid/92319","http://www.securitytracker.com/id/1036538","http://www.securitytracker.com/id/1038341","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803A.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5419","description":"curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session."}]},{"artifact":{"id":"5729611933088ab4","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.12%2Bdfsg-2ubuntu5.2?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-10-07","epss":0.14859,"percentile":0.96617}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-10-07","epss":0.14859,"percentile":0.96617}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"ce758c0024b5fdb9","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.12%2Bdfsg-2ubuntu5.2?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-10-07","epss":0.14859,"percentile":0.96617}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-10-07","epss":0.14859,"percentile":0.96617}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"9a9b8e1c27a04422","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.12%2Bdfsg-2ubuntu5.2?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-10-07","epss":0.14859,"percentile":0.96617}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-10-07","epss":0.14859,"percentile":0.96617}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"33e67ade259e89cd","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.12%2Bdfsg-2ubuntu5.2?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-3596","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2024-3596","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-10-07","epss":0.14859,"percentile":0.96617}],"risk":7.4295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-3596"},"relatedVulnerabilities":[{"id":"CVE-2024-3596","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-3596","cwe":"CWE-354","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-3596","cwe":"CWE-924","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2024-3596","date":"2026-10-07","epss":0.14859,"percentile":0.96617}],"urls":["http://www.openwall.com/lists/oss-security/2024/07/09/4","https://cert-portal.siemens.com/productcert/html/ssa-723487.html","https://cert-portal.siemens.com/productcert/html/ssa-794185.html","https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/","https://datatracker.ietf.org/doc/html/rfc2865","https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014","https://www.blastradius.fail/","https://security.netapp.com/advisory/ntap-20240822-0001/","https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol","https://www.kb.cert.org/vuls/id/456537","https://cert-portal.siemens.com/productcert/html/ssa-364175.html","https://cert-portal.siemens.com/productcert/html/ssa-770770.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-3596","description":"RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-0772","versionConstraint":"< 3.4.3-1ubuntu1~14.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-0772","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.5"],"available":[{"date":"2016-11-22","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-0772","cwe":"CWE-693","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0772","date":"2026-10-07","epss":0.14524,"percentile":0.96558}],"risk":7.2620000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-0772"},"relatedVulnerabilities":[{"id":"CVE-2016-0772","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-0772","cwe":"CWE-693","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0772","date":"2026-10-07","epss":0.14524,"percentile":0.96558}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://rhn.redhat.com/errata/RHSA-2016-1626.html","http://rhn.redhat.com/errata/RHSA-2016-1627.html","http://rhn.redhat.com/errata/RHSA-2016-1628.html","http://rhn.redhat.com/errata/RHSA-2016-1629.html","http://rhn.redhat.com/errata/RHSA-2016-1630.html","http://www.openwall.com/lists/oss-security/2016/06/14/9","http://www.securityfocus.com/bid/91225","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bugzilla.redhat.com/show_bug.cgi?id=1303647","https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2","https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS","https://hg.python.org/cpython/rev/b3ce713fb9be","https://hg.python.org/cpython/rev/d590114c2394","https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html","https://security.gentoo.org/glsa/201701-18"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-0772","description":"The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a \"StartTLS stripping attack.\""}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-0772","versionConstraint":"< 3.4.3-1ubuntu1~14.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-0772","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.5"],"available":[{"date":"2016-11-22","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-0772","cwe":"CWE-693","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0772","date":"2026-10-07","epss":0.14524,"percentile":0.96558}],"risk":7.2620000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-0772"},"relatedVulnerabilities":[{"id":"CVE-2016-0772","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-0772","cwe":"CWE-693","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0772","date":"2026-10-07","epss":0.14524,"percentile":0.96558}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://rhn.redhat.com/errata/RHSA-2016-1626.html","http://rhn.redhat.com/errata/RHSA-2016-1627.html","http://rhn.redhat.com/errata/RHSA-2016-1628.html","http://rhn.redhat.com/errata/RHSA-2016-1629.html","http://rhn.redhat.com/errata/RHSA-2016-1630.html","http://www.openwall.com/lists/oss-security/2016/06/14/9","http://www.securityfocus.com/bid/91225","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bugzilla.redhat.com/show_bug.cgi?id=1303647","https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2","https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS","https://hg.python.org/cpython/rev/b3ce713fb9be","https://hg.python.org/cpython/rev/d590114c2394","https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html","https://security.gentoo.org/glsa/201701-18"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-0772","description":"The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a \"StartTLS stripping attack.\""}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-0772","versionConstraint":"< 3.4.3-1ubuntu1~14.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-0772","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.5"],"available":[{"date":"2016-11-22","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-0772","cwe":"CWE-693","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0772","date":"2026-10-07","epss":0.14524,"percentile":0.96558}],"risk":7.2620000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-0772"},"relatedVulnerabilities":[{"id":"CVE-2016-0772","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-0772","cwe":"CWE-693","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0772","date":"2026-10-07","epss":0.14524,"percentile":0.96558}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://rhn.redhat.com/errata/RHSA-2016-1626.html","http://rhn.redhat.com/errata/RHSA-2016-1627.html","http://rhn.redhat.com/errata/RHSA-2016-1628.html","http://rhn.redhat.com/errata/RHSA-2016-1629.html","http://rhn.redhat.com/errata/RHSA-2016-1630.html","http://www.openwall.com/lists/oss-security/2016/06/14/9","http://www.securityfocus.com/bid/91225","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bugzilla.redhat.com/show_bug.cgi?id=1303647","https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2","https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS","https://hg.python.org/cpython/rev/b3ce713fb9be","https://hg.python.org/cpython/rev/d590114c2394","https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html","https://security.gentoo.org/glsa/201701-18"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-0772","description":"The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a \"StartTLS stripping attack.\""}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-0772","versionConstraint":"< 3.4.3-1ubuntu1~14.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-0772","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.5"],"available":[{"date":"2016-11-22","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-0772","cwe":"CWE-693","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0772","date":"2026-10-07","epss":0.14524,"percentile":0.96558}],"risk":7.2620000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-0772"},"relatedVulnerabilities":[{"id":"CVE-2016-0772","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","metrics":{"baseScore":5.8,"impactScore":5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-0772","cwe":"CWE-693","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-0772","date":"2026-10-07","epss":0.14524,"percentile":0.96558}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://rhn.redhat.com/errata/RHSA-2016-1626.html","http://rhn.redhat.com/errata/RHSA-2016-1627.html","http://rhn.redhat.com/errata/RHSA-2016-1628.html","http://rhn.redhat.com/errata/RHSA-2016-1629.html","http://rhn.redhat.com/errata/RHSA-2016-1630.html","http://www.openwall.com/lists/oss-security/2016/06/14/9","http://www.securityfocus.com/bid/91225","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://bugzilla.redhat.com/show_bug.cgi?id=1303647","https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-5","https://docs.python.org/3.5/whatsnew/changelog.html#python-3-5-2","https://hg.python.org/cpython/raw-file/v2.7.12/Misc/NEWS","https://hg.python.org/cpython/rev/b3ce713fb9be","https://hg.python.org/cpython/rev/d590114c2394","https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html","https://security.gentoo.org/glsa/201701-18"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-0772","description":"The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a \"StartTLS stripping attack.\""}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2181","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2181","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2181","cwe":"CWE-189","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2181","date":"2026-10-07","epss":0.22634,"percentile":0.9767}],"risk":6.7902000000000005,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2181"},"relatedVulnerabilities":[{"id":"CVE-2016-2181","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2181","cwe":"CWE-189","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2181","date":"2026-10-07","epss":0.22634,"percentile":0.9767}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92982","http://www.securitytracker.com/id/1036690","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=1fb9fdc3027b27d8eb6a1e6a846435b070980770","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://support.f5.com/csp/article/K59298921","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2181","description":"The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.20"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2181","versionConstraint":"< 1.0.1f-1ubuntu2.20 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2181","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.20"],"available":[{"date":"2016-09-22","kind":"advisory","version":"1.0.1f-1ubuntu2.20"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2181","cwe":"CWE-189","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2181","date":"2026-10-07","epss":0.22634,"percentile":0.9767}],"risk":6.7902000000000005,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2181"},"relatedVulnerabilities":[{"id":"CVE-2016-2181","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2181","cwe":"CWE-189","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2181","date":"2026-10-07","epss":0.22634,"percentile":0.9767}],"urls":["http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html","http://rhn.redhat.com/errata/RHSA-2016-1940.html","http://seclists.org/fulldisclosure/2017/Jul/31","http://www-01.ibm.com/support/docview.wss?uid=swg21995039","http://www.debian.org/security/2016/dsa-3673","http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html","http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html","http://www.securityfocus.com/bid/92982","http://www.securitytracker.com/id/1036690","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","http://www.ubuntu.com/usn/USN-3087-1","http://www.ubuntu.com/usn/USN-3087-2","https://bto.bluecoat.com/security-advisory/sa132","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=1fb9fdc3027b27d8eb6a1e6a846435b070980770","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312","https://kc.mcafee.com/corporate/index?page=content&id=SB10215","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc","https://support.f5.com/csp/article/K59298921","https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24","https://www.tenable.com/security/tns-2016-16","https://www.tenable.com/security/tns-2016-20","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2181","description":"The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c."}]},{"artifact":{"id":"ec58b33e5c146070","cpes":["cpe:2.3:a:vim-common:vim-common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim-common:vim_common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim-common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim_common:vim_common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_common:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*"],"name":"vim-common","purl":"pkg:deb/ubuntu/vim-common@2%3A7.4.052-1ubuntu3?arch=amd64&distro=ubuntu-14.04&upstream=vim","type":"deb","version":"2:7.4.052-1ubuntu3","language":"","licenses":["sha256:8961cb2b1d5fe792b9290a72bd12b2cd49641cdb39026093ed750690034e54d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/vim-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.conffiles","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-common.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-common.list"},{"path":"/var/lib/dpkg/info/vim-common.preinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-common.preinst"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0714","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"vim","version":"2:7.4.052-1ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0714","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0714","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0714","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0714","date":"2026-10-07","epss":0.12712,"percentile":0.96171}],"risk":6.356000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0714"},"relatedVulnerabilities":[{"id":"CVE-2022-0714","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0714","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0714","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0714","date":"2026-10-07","epss":0.12712,"percentile":0.96171}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://github.com/vim/vim/commit/4e889f98e95ac05d7c8bd3ee933ab4d47820fdfa","https://huntr.dev/bounties/db70e8db-f309-4f3c-986c-e69d2415c3b3","https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HBUYQBZ6GWAWJRWP7AODJ4KHW5BCKDVP/","https://security.gentoo.org/glsa/202208-32","https://support.apple.com/kb/HT213488"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0714","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436."}]},{"artifact":{"id":"927afdc7c4c7d9a0","cpes":["cpe:2.3:a:vim-tiny:vim-tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim-tiny:vim_tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim-tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim_tiny:vim_tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim-tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*","cpe:2.3:a:vim:vim_tiny:2\\:7.4.052-1ubuntu3:*:*:*:*:*:*:*"],"name":"vim-tiny","purl":"pkg:deb/ubuntu/vim-tiny@2%3A7.4.052-1ubuntu3?arch=amd64&distro=ubuntu-14.04&upstream=vim","type":"deb","version":"2:7.4.052-1ubuntu3","language":"","licenses":["sha256:8961cb2b1d5fe792b9290a72bd12b2cd49641cdb39026093ed750690034e54d3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/vim-common/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/vim-tiny/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.conffiles","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/vim-tiny.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.list"},{"path":"/var/lib/dpkg/info/vim-tiny.postinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.postinst"},{"path":"/var/lib/dpkg/info/vim-tiny.prerm","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/vim-tiny.prerm"}],"upstreams":[{"name":"vim"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0714","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"vim","version":"2:7.4.052-1ubuntu3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0714","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0714","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0714","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0714","date":"2026-10-07","epss":0.12712,"percentile":0.96171}],"risk":6.356000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0714"},"relatedVulnerabilities":[{"id":"CVE-2022-0714","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"security@huntr.dev","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0714","cwe":"CWE-122","type":"Secondary","source":"security@huntr.dev"},{"cve":"CVE-2022-0714","cwe":"CWE-787","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0714","date":"2026-10-07","epss":0.12712,"percentile":0.96171}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://github.com/vim/vim/commit/4e889f98e95ac05d7c8bd3ee933ab4d47820fdfa","https://huntr.dev/bounties/db70e8db-f309-4f3c-986c-e69d2415c3b3","https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html","https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HBUYQBZ6GWAWJRWP7AODJ4KHW5BCKDVP/","https://security.gentoo.org/glsa/202208-32","https://support.apple.com/kb/HT213488"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0714","description":"Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.23"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-3735","versionConstraint":"< 1.0.1f-1ubuntu2.23 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-3735","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.23"],"available":[{"date":"2017-11-06","kind":"advisory","version":"1.0.1f-1ubuntu2.23"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-07","epss":0.20968,"percentile":0.9751}],"risk":6.2904,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-3735"},"relatedVulnerabilities":[{"id":"CVE-2017-3735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-07","epss":0.20968,"percentile":0.9751}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/100515","http://www.securitytracker.com/id/1039726","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822","https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc","https://security.gentoo.org/glsa/201712-03","https://security.netapp.com/advisory/ntap-20170927-0001/","https://security.netapp.com/advisory/ntap-20171107-0002/","https://support.apple.com/HT208331","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2017/dsa-4017","https://www.debian.org/security/2017/dsa-4018","https://www.openssl.org/news/secadv/20170828.txt","https://www.openssl.org/news/secadv/20171102.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2017-14","https://www.tenable.com/security/tns-2017-15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3735","description":"While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.23"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-3735","versionConstraint":"< 1.0.1f-1ubuntu2.23 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-3735","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.23"],"available":[{"date":"2017-11-06","kind":"advisory","version":"1.0.1f-1ubuntu2.23"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-07","epss":0.20968,"percentile":0.9751}],"risk":6.2904,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-3735"},"relatedVulnerabilities":[{"id":"CVE-2017-3735","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-3735","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-3735","date":"2026-10-07","epss":0.20968,"percentile":0.9751}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/100515","http://www.securitytracker.com/id/1039726","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822","https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html","https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc","https://security.gentoo.org/glsa/201712-03","https://security.netapp.com/advisory/ntap-20170927-0001/","https://security.netapp.com/advisory/ntap-20171107-0002/","https://support.apple.com/HT208331","https://usn.ubuntu.com/3611-2/","https://www.debian.org/security/2017/dsa-4017","https://www.debian.org/security/2017/dsa-4018","https://www.openssl.org/news/secadv/20170828.txt","https://www.openssl.org/news/secadv/20171102.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2017-14","https://www.tenable.com/security/tns-2017-15"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-3735","description":"While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g."}]},{"artifact":{"id":"3695a31b2933dc8f","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6110","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-6110","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6110","date":"2026-10-07","epss":0.20906,"percentile":0.97505}],"risk":6.2718,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6110"},"relatedVulnerabilities":[{"id":"CVE-2019-6110","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6110","date":"2026-10-07","epss":0.20906,"percentile":0.97505}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c","https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","https://security.gentoo.org/glsa/201903-16","https://security.netapp.com/advisory/ntap-20190213-0001/","https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","https://www.exploit-db.com/exploits/46193/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6110","description":"In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred."}]},{"artifact":{"id":"54d7c6e40533c708","cpes":["cpe:2.3:a:openssh-server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-server","purl":"pkg:deb/ubuntu/openssh-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.config","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.config"},{"path":"/var/lib/dpkg/info/openssh-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.list"},{"path":"/var/lib/dpkg/info/openssh-server.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postinst"},{"path":"/var/lib/dpkg/info/openssh-server.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postrm"},{"path":"/var/lib/dpkg/info/openssh-server.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.preinst"},{"path":"/var/lib/dpkg/info/openssh-server.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.prerm"},{"path":"/var/lib/dpkg/info/openssh-server.templates","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.templates"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6110","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-6110","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6110","date":"2026-10-07","epss":0.20906,"percentile":0.97505}],"risk":6.2718,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6110"},"relatedVulnerabilities":[{"id":"CVE-2019-6110","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6110","date":"2026-10-07","epss":0.20906,"percentile":0.97505}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c","https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","https://security.gentoo.org/glsa/201903-16","https://security.netapp.com/advisory/ntap-20190213-0001/","https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","https://www.exploit-db.com/exploits/46193/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6110","description":"In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred."}]},{"artifact":{"id":"b3db4be88de03e2f","cpes":["cpe:2.3:a:openssh-sftp-server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp-server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-sftp-server","purl":"pkg:deb/ubuntu/openssh-sftp-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-sftp-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.list"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-6110","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-6110","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6110","date":"2026-10-07","epss":0.20906,"percentile":0.97505}],"risk":6.2718,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-6110"},"relatedVulnerabilities":[{"id":"CVE-2019-6110","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","metrics":{"baseScore":4,"impactScore":5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-6110","cwe":"CWE-838","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-6110","date":"2026-10-07","epss":0.20906,"percentile":0.97505}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c","https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c","https://security.gentoo.org/glsa/201903-16","https://security.netapp.com/advisory/ntap-20190213-0001/","https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt","https://www.exploit-db.com/exploits/46193/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-6110","description":"In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-10-07","epss":0.20743,"percentile":0.97483}],"risk":6.2229,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5010"},"relatedVulnerabilities":[{"id":"CVE-2019-5010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-10-07","epss":0.20743,"percentile":0.97483}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://security.gentoo.org/glsa/202003-26","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5010","description":"An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-10-07","epss":0.20743,"percentile":0.97483}],"risk":6.2229,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5010"},"relatedVulnerabilities":[{"id":"CVE-2019-5010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-10-07","epss":0.20743,"percentile":0.97483}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://security.gentoo.org/glsa/202003-26","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5010","description":"An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-5010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-10-07","epss":0.20743,"percentile":0.97483}],"risk":6.2229,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5010"},"relatedVulnerabilities":[{"id":"CVE-2019-5010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-10-07","epss":0.20743,"percentile":0.97483}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://security.gentoo.org/glsa/202003-26","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5010","description":"An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-5010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-5010","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-10-07","epss":0.20743,"percentile":0.97483}],"risk":6.2229,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-5010"},"relatedVulnerabilities":[{"id":"CVE-2019-5010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"talos-cna@cisco.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Secondary","source":"talos-cna@cisco.com"},{"cve":"CVE-2019-5010","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-5010","date":"2026-10-07","epss":0.20743,"percentile":0.97483}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://security.gentoo.org/glsa/202003-26","https://talosintelligence.com/vulnerability_reports/TALOS-2019-0758"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-5010","description":"An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability."}]},{"artifact":{"id":"f93e78451600da86","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.2?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.2","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-36230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-36230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-36230","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36230","date":"2026-10-07","epss":0.1229,"percentile":0.96088}],"risk":6.145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-36230"},"relatedVulnerabilities":[{"id":"CVE-2020-36230","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-36230","cwe":"CWE-617","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-36230","date":"2026-10-07","epss":0.1229,"percentile":0.96088}],"urls":["http://seclists.org/fulldisclosure/2021/May/64","http://seclists.org/fulldisclosure/2021/May/65","http://seclists.org/fulldisclosure/2021/May/70","https://bugs.openldap.org/show_bug.cgi?id=9423","https://git.openldap.org/openldap/openldap/-/commit/8c1d96ee36ed98b32cd0e28b7069c7b8ea09d793","https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html","https://security.netapp.com/advisory/ntap-20210226-0002/","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212530","https://support.apple.com/kb/HT212531","https://www.debian.org/security/2021/dsa-4845"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-36230","description":"A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service."}]},{"artifact":{"id":"328fe217962e5779","cpes":["cpe:2.3:a:sudo:sudo:1.8.9p5-1ubuntu1.2:*:*:*:*:*:*:*"],"name":"sudo","purl":"pkg:deb/ubuntu/sudo@1.8.9p5-1ubuntu1.2?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.8.9p5-1ubuntu1.2","language":"","licenses":["BSD-3-Clause","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/sudo/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/sudo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.list"},{"path":"/var/lib/dpkg/info/sudo.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.postinst"},{"path":"/var/lib/dpkg/info/sudo.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.postrm"},{"path":"/var/lib/dpkg/info/sudo.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.preinst"},{"path":"/var/lib/dpkg/info/sudo.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.8.9p5-1ubuntu1.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-1000367","versionConstraint":"< 1.8.9p5-1ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sudo","version":"1.8.9p5-1ubuntu1.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000367","fix":{"state":"fixed","versions":["1.8.9p5-1ubuntu1.4"],"available":[{"date":"2017-05-30","kind":"advisory","version":"1.8.9p5-1ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000367","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000367","date":"2026-10-07","epss":0.08003,"percentile":0.94625}],"risk":6.002250000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000367"},"relatedVulnerabilities":[{"id":"CVE-2017-1000367","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","metrics":{"baseScore":6.9,"impactScore":10.1,"exploitabilityScore":3.4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000367","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000367","date":"2026-10-07","epss":0.08003,"percentile":0.94625}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.html","http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.html","http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.html","http://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.html","http://seclists.org/fulldisclosure/2017/Jun/3","http://www.debian.org/security/2017/dsa-3867","http://www.openwall.com/lists/oss-security/2017/05/30/16","http://www.openwall.com/lists/oss-security/2022/12/22/5","http://www.openwall.com/lists/oss-security/2022/12/22/6","http://www.securityfocus.com/bid/98745","http://www.securitytracker.com/id/1038582","http://www.ubuntu.com/usn/USN-3304-1","https://access.redhat.com/errata/RHSA-2017:1381","https://access.redhat.com/errata/RHSA-2017:1382","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO/","https://security.gentoo.org/glsa/201705-15","https://www.exploit-db.com/exploits/42183/","https://www.sudo.ws/alerts/linux_tty.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000367","description":"Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-07","epss":0.11844,"percentile":0.95995}],"risk":5.922000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9948"},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-07","epss":0.11844,"percentile":0.95995}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-07","epss":0.11844,"percentile":0.95995}],"risk":5.922000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9948"},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-07","epss":0.11844,"percentile":0.95995}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-07","epss":0.11844,"percentile":0.95995}],"risk":5.922000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9948"},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-07","epss":0.11844,"percentile":0.95995}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9948","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-07","epss":0.11844,"percentile":0.95995}],"risk":5.922000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9948"},"relatedVulnerabilities":[{"id":"CVE-2019-9948","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9948","cwe":"CWE-22","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9948","date":"2026-10-07","epss":0.11844,"percentile":0.95995}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.securityfocus.com/bid/107549","https://access.redhat.com/errata/RHSA-2019:1700","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://bugs.python.org/issue35907","https://github.com/python/cpython/pull/11842","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190404-0004/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9948","description":"urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call."}]},{"artifact":{"id":"71081c257357e0b6","cpes":["cpe:2.3:a:perl:perl:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-18311","versionConstraint":"< 5.18.2-2ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18311","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.7"],"available":[{"date":"2018-12-03","kind":"advisory","version":"5.18.2-2ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-07","epss":0.11676,"percentile":0.9596}],"risk":5.838,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18311"},"relatedVulnerabilities":[{"id":"CVE-2018-18311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-07","epss":0.11676,"percentile":0.9596}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/106145","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://access.redhat.com/errata/RHSA-2019:0109","https://access.redhat.com/errata/RHSA-2019:1790","https://access.redhat.com/errata/RHSA-2019:1942","https://access.redhat.com/errata/RHSA-2019:2400","https://bugzilla.redhat.com/show_bug.cgi?id=1646730","https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://metacpan.org/changes/release/SHAY/perl-5.28.1","https://rt.perl.org/Ticket/Display.html?id=133204","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18311","description":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."}]},{"artifact":{"id":"b6e547621bce8e70","cpes":["cpe:2.3:a:perl-base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18311","versionConstraint":"< 5.18.2-2ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18311","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.7"],"available":[{"date":"2018-12-03","kind":"advisory","version":"5.18.2-2ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-07","epss":0.11676,"percentile":0.9596}],"risk":5.838,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18311"},"relatedVulnerabilities":[{"id":"CVE-2018-18311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-07","epss":0.11676,"percentile":0.9596}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/106145","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://access.redhat.com/errata/RHSA-2019:0109","https://access.redhat.com/errata/RHSA-2019:1790","https://access.redhat.com/errata/RHSA-2019:1942","https://access.redhat.com/errata/RHSA-2019:2400","https://bugzilla.redhat.com/show_bug.cgi?id=1646730","https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://metacpan.org/changes/release/SHAY/perl-5.28.1","https://rt.perl.org/Ticket/Display.html?id=133204","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18311","description":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."}]},{"artifact":{"id":"9a3f82ec97b0252b","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/ubuntu/perl-modules@5.18.2-2ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18311","versionConstraint":"< 5.18.2-2ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18311","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.7"],"available":[{"date":"2018-12-03","kind":"advisory","version":"5.18.2-2ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-07","epss":0.11676,"percentile":0.9596}],"risk":5.838,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18311"},"relatedVulnerabilities":[{"id":"CVE-2018-18311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18311","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-18311","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18311","date":"2026-10-07","epss":0.11676,"percentile":0.9596}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/106145","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://access.redhat.com/errata/RHSA-2019:0109","https://access.redhat.com/errata/RHSA-2019:1790","https://access.redhat.com/errata/RHSA-2019:1942","https://access.redhat.com/errata/RHSA-2019:2400","https://bugzilla.redhat.com/show_bug.cgi?id=1646730","https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","https://kc.mcafee.com/corporate/index?page=content&id=SB10278","https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://metacpan.org/changes/release/SHAY/perl-5.28.1","https://rt.perl.org/Ticket/Display.html?id=133204","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18311","description":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000120","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000120","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-07","epss":0.11608,"percentile":0.95943}],"risk":5.804,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000120"},"relatedVulnerabilities":[{"id":"CVE-2018-1000120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-07","epss":0.11608,"percentile":0.95943}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103414","http://www.securitytracker.com/id/1040531","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-9cd6.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000120","description":"A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000120","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000120","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-07","epss":0.11608,"percentile":0.95943}],"risk":5.804,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000120"},"relatedVulnerabilities":[{"id":"CVE-2018-1000120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-07","epss":0.11608,"percentile":0.95943}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103414","http://www.securitytracker.com/id/1040531","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-9cd6.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000120","description":"A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000120","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000120","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-07","epss":0.11608,"percentile":0.95943}],"risk":5.804,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000120"},"relatedVulnerabilities":[{"id":"CVE-2018-1000120","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000120","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000120","date":"2026-10-07","epss":0.11608,"percentile":0.95943}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103414","http://www.securitytracker.com/id/1040531","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-9cd6.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000120","description":"A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3737","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3737","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-07","epss":0.11586,"percentile":0.95939}],"risk":5.793,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3737"},"relatedVulnerabilities":[{"id":"CVE-2021-3737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-07","epss":0.11586,"percentile":0.95939}],"urls":["https://bugs.python.org/issue44022","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/25916","https://github.com/python/cpython/pull/26503","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3737","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3737","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-07","epss":0.11586,"percentile":0.95939}],"risk":5.793,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3737"},"relatedVulnerabilities":[{"id":"CVE-2021-3737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-07","epss":0.11586,"percentile":0.95939}],"urls":["https://bugs.python.org/issue44022","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/25916","https://github.com/python/cpython/pull/26503","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-3737","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3737","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-07","epss":0.11586,"percentile":0.95939}],"risk":5.793,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3737"},"relatedVulnerabilities":[{"id":"CVE-2021-3737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-07","epss":0.11586,"percentile":0.95939}],"urls":["https://bugs.python.org/issue44022","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/25916","https://github.com/python/cpython/pull/26503","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-3737","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-3737","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-07","epss":0.11586,"percentile":0.95939}],"risk":5.793,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-3737"},"relatedVulnerabilities":[{"id":"CVE-2021-3737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2021-3737","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-3737","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-3737","date":"2026-10-07","epss":0.11586,"percentile":0.95939}],"urls":["https://bugs.python.org/issue44022","https://bugzilla.redhat.com/show_bug.cgi?id=1995162","https://github.com/python/cpython/pull/25916","https://github.com/python/cpython/pull/26503","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html","https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html","https://security.netapp.com/advisory/ntap-20220407-0009/","https://ubuntu.com/security/CVE-2021-3737","https://www.oracle.com/security-alerts/cpujul2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-3737","description":"A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability."}]},{"artifact":{"id":"328fe217962e5779","cpes":["cpe:2.3:a:sudo:sudo:1.8.9p5-1ubuntu1.2:*:*:*:*:*:*:*"],"name":"sudo","purl":"pkg:deb/ubuntu/sudo@1.8.9p5-1ubuntu1.2?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.8.9p5-1ubuntu1.2","language":"","licenses":["BSD-3-Clause","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/sudo/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/sudo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.list"},{"path":"/var/lib/dpkg/info/sudo.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.postinst"},{"path":"/var/lib/dpkg/info/sudo.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.postrm"},{"path":"/var/lib/dpkg/info/sudo.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.preinst"},{"path":"/var/lib/dpkg/info/sudo.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-18634","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sudo","version":"1.8.9p5-1ubuntu1.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-18634","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-18634","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-18634","date":"2026-10-07","epss":0.19276,"percentile":0.97279}],"risk":5.782799999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-18634"},"relatedVulnerabilities":[{"id":"CVE-2019-18634","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":4.6,"impactScore":6.5,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-18634","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-18634","date":"2026-10-07","epss":0.19276,"percentile":0.97279}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00029.html","http://packetstormsecurity.com/files/156174/Slackware-Security-Advisory-sudo-Updates.html","http://packetstormsecurity.com/files/156189/Sudo-1.8.25p-Buffer-Overflow.html","http://seclists.org/fulldisclosure/2020/Jan/40","http://www.openwall.com/lists/oss-security/2020/01/30/6","http://www.openwall.com/lists/oss-security/2020/01/31/1","http://www.openwall.com/lists/oss-security/2020/02/05/2","http://www.openwall.com/lists/oss-security/2020/02/05/5","https://access.redhat.com/errata/RHSA-2020:0487","https://access.redhat.com/errata/RHSA-2020:0509","https://access.redhat.com/errata/RHSA-2020:0540","https://access.redhat.com/errata/RHSA-2020:0726","https://lists.debian.org/debian-lts-announce/2020/02/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6TKF36KOQUVJNBHSVJFA7BU3CCEYD2F/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IY6DZ7WMDKU4ZDML6MJLDAPG42B5WVUC/","https://seclists.org/bugtraq/2020/Feb/2","https://seclists.org/bugtraq/2020/Feb/3","https://seclists.org/bugtraq/2020/Jan/44","https://security.gentoo.org/glsa/202003-12","https://security.netapp.com/advisory/ntap-20200210-0001/","https://support.apple.com/kb/HT210919","https://usn.ubuntu.com/4263-1/","https://usn.ubuntu.com/4263-2/","https://www.debian.org/security/2020/dsa-4614","https://www.sudo.ws/alerts/pwfeedback.html","https://www.sudo.ws/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-18634","description":"In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist only if enabled by an administrator.) The attacker needs to deliver a long string to the stdin of getln() in tgetpass.c."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-8817","versionConstraint":"< 7.35.0-1ubuntu2.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-8817","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.13"],"available":[{"date":"2017-11-29","kind":"advisory","version":"7.35.0-1ubuntu2.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-07","epss":0.11175,"percentile":0.9585}],"risk":5.5875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-8817"},"relatedVulnerabilities":[{"id":"CVE-2017-8817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-07","epss":0.11175,"percentile":0.9585}],"urls":["http://security.cucumberlinux.com/security/details.php?id=162","http://www.securityfocus.com/bid/102057","http://www.securitytracker.com/id/1039897","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-ae72.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8817","description":"The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8817","versionConstraint":"< 7.35.0-1ubuntu2.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-8817","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.13"],"available":[{"date":"2017-11-29","kind":"advisory","version":"7.35.0-1ubuntu2.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-07","epss":0.11175,"percentile":0.9585}],"risk":5.5875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-8817"},"relatedVulnerabilities":[{"id":"CVE-2017-8817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-07","epss":0.11175,"percentile":0.9585}],"urls":["http://security.cucumberlinux.com/security/details.php?id=162","http://www.securityfocus.com/bid/102057","http://www.securitytracker.com/id/1039897","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-ae72.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8817","description":"The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-8817","versionConstraint":"< 7.35.0-1ubuntu2.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-8817","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.13"],"available":[{"date":"2017-11-29","kind":"advisory","version":"7.35.0-1ubuntu2.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-07","epss":0.11175,"percentile":0.9585}],"risk":5.5875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-8817"},"relatedVulnerabilities":[{"id":"CVE-2017-8817","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-8817","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-8817","date":"2026-10-07","epss":0.11175,"percentile":0.9585}],"urls":["http://security.cucumberlinux.com/security/details.php?id=162","http://www.securityfocus.com/bid/102057","http://www.securitytracker.com/id/1039897","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_2017-ae72.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00040.html","https://security.gentoo.org/glsa/201712-04","https://www.debian.org/security/2017/dsa-4051"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-8817","description":"The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-14618","versionConstraint":"< 7.35.0-1ubuntu2.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14618","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.17"],"available":[{"date":"2018-09-17","kind":"advisory","version":"7.35.0-1ubuntu2.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-07","epss":0.11115,"percentile":0.95835}],"risk":5.5575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14618"},"relatedVulnerabilities":[{"id":"CVE-2018-14618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-07","epss":0.11115,"percentile":0.95835}],"urls":["http://www.securitytracker.com/id/1041605","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1880","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-14618.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3765-1/","https://usn.ubuntu.com/3765-2/","https://www.debian.org/security/2018/dsa-4286"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14618","description":"curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)"}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14618","versionConstraint":"< 7.35.0-1ubuntu2.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14618","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.17"],"available":[{"date":"2018-09-17","kind":"advisory","version":"7.35.0-1ubuntu2.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-07","epss":0.11115,"percentile":0.95835}],"risk":5.5575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14618"},"relatedVulnerabilities":[{"id":"CVE-2018-14618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-07","epss":0.11115,"percentile":0.95835}],"urls":["http://www.securitytracker.com/id/1041605","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1880","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-14618.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3765-1/","https://usn.ubuntu.com/3765-2/","https://www.debian.org/security/2018/dsa-4286"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14618","description":"curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)"}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14618","versionConstraint":"< 7.35.0-1ubuntu2.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14618","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.17"],"available":[{"date":"2018-09-17","kind":"advisory","version":"7.35.0-1ubuntu2.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-07","epss":0.11115,"percentile":0.95835}],"risk":5.5575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14618"},"relatedVulnerabilities":[{"id":"CVE-2018-14618","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14618","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-131","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14618","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14618","date":"2026-10-07","epss":0.11115,"percentile":0.95835}],"urls":["http://www.securitytracker.com/id/1041605","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1880","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618","https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf","https://curl.haxx.se/docs/CVE-2018-14618.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3765-1/","https://usn.ubuntu.com/3765-2/","https://www.debian.org/security/2018/dsa-4286"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14618","description":"curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)"}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14647","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-10-07","epss":0.10911,"percentile":0.95773}],"risk":5.4555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14647"},"relatedVulnerabilities":[{"id":"CVE-2018-14647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-10-07","epss":0.10911,"percentile":0.95773}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14647","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-10-07","epss":0.10911,"percentile":0.95773}],"risk":5.4555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14647"},"relatedVulnerabilities":[{"id":"CVE-2018-14647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-10-07","epss":0.10911,"percentile":0.95773}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-14647","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-10-07","epss":0.10911,"percentile":0.95773}],"risk":5.4555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14647"},"relatedVulnerabilities":[{"id":"CVE-2018-14647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-10-07","epss":0.10911,"percentile":0.95773}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-14647","versionConstraint":"< 3.4.3-1ubuntu1~14.04.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-14647","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.7"],"available":[{"date":"2018-11-13","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-10-07","epss":0.10911,"percentile":0.95773}],"risk":5.4555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-14647"},"relatedVulnerabilities":[{"id":"CVE-2018-14647","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-14647","cwe":"CWE-335","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-665","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-14647","cwe":"CWE-909","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-14647","date":"2026-10-07","epss":0.10911,"percentile":0.95773}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/105396","http://www.securitytracker.com/id/1041740","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue34623","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14647","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBJCB2HWOJLP3L7CUQHJHNBHLSVOXJE5/","https://usn.ubuntu.com/3817-1/","https://usn.ubuntu.com/3817-2/","https://www.debian.org/security/2018/dsa-4306","https://www.debian.org/security/2018/dsa-4307"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-14647","description":"Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15."}]},{"artifact":{"id":"8f1c215749686bf0","cpes":["cpe:2.3:a:apt:apt:1.0.1ubuntu2.14:*:*:*:*:*:*:*"],"name":"apt","purl":"pkg:deb/ubuntu/apt@1.0.1ubuntu2.14?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1ubuntu2.14","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/apt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt.list"},{"path":"/var/lib/dpkg/info/apt.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt.postinst"},{"path":"/var/lib/dpkg/info/apt.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt.postrm"},{"path":"/var/lib/dpkg/info/apt.shlibs","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt.shlibs"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.17"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-1252","versionConstraint":"< 1.0.1ubuntu2.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.14"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-1252","fix":{"state":"fixed","versions":["1.0.1ubuntu2.17"],"available":[{"date":"2016-12-13","kind":"advisory","version":"1.0.1ubuntu2.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-07","epss":0.07248,"percentile":0.94184}],"risk":5.436000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-1252"},"relatedVulnerabilities":[{"id":"CVE-2016-1252","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-07","epss":0.07248,"percentile":0.94184}],"urls":["http://packetstormsecurity.com/files/140145/apt-Repository-Signing-Bypass.html","http://www.ubuntu.com/usn/USN-3156-1","https://bugs.chromium.org/p/project-zero/issues/detail?id=1020","https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467","https://www.debian.org/security/2016/dsa-3733","https://www.exploit-db.com/exploits/40916/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1252","description":"The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures."}]},{"artifact":{"id":"1112ff219ad241d3","cpes":["cpe:2.3:a:apt-transport-https:apt-transport-https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt-transport-https:apt_transport_https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt_transport_https:apt-transport-https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt_transport_https:apt_transport_https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt-transport:apt-transport-https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt-transport:apt_transport_https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt_transport:apt-transport-https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt_transport:apt_transport_https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt:apt-transport-https:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt:apt_transport_https:1.0.1ubuntu2.14:*:*:*:*:*:*:*"],"name":"apt-transport-https","purl":"pkg:deb/ubuntu/apt-transport-https@1.0.1ubuntu2.14?arch=amd64&distro=ubuntu-14.04&upstream=apt","type":"deb","version":"1.0.1ubuntu2.14","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt-transport-https/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/apt-transport-https/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt-transport-https.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt-transport-https.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt-transport-https.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt-transport-https.list"}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-1252","versionConstraint":"< 1.0.1ubuntu2.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.14"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-1252","fix":{"state":"fixed","versions":["1.0.1ubuntu2.17"],"available":[{"date":"2016-12-13","kind":"advisory","version":"1.0.1ubuntu2.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-07","epss":0.07248,"percentile":0.94184}],"risk":5.436000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-1252"},"relatedVulnerabilities":[{"id":"CVE-2016-1252","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-07","epss":0.07248,"percentile":0.94184}],"urls":["http://packetstormsecurity.com/files/140145/apt-Repository-Signing-Bypass.html","http://www.ubuntu.com/usn/USN-3156-1","https://bugs.chromium.org/p/project-zero/issues/detail?id=1020","https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467","https://www.debian.org/security/2016/dsa-3733","https://www.exploit-db.com/exploits/40916/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1252","description":"The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures."}]},{"artifact":{"id":"9fe37a2b70adefe3","cpes":["cpe:2.3:a:apt-utils:apt-utils:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt-utils:apt_utils:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt_utils:apt-utils:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt_utils:apt_utils:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt:apt-utils:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:apt:apt_utils:1.0.1ubuntu2.14:*:*:*:*:*:*:*"],"name":"apt-utils","purl":"pkg:deb/ubuntu/apt-utils@1.0.1ubuntu2.14?arch=amd64&distro=ubuntu-14.04&upstream=apt","type":"deb","version":"1.0.1ubuntu2.14","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt-utils/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/apt-utils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt-utils.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt-utils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt-utils.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/apt-utils.list"}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-1252","versionConstraint":"< 1.0.1ubuntu2.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.14"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-1252","fix":{"state":"fixed","versions":["1.0.1ubuntu2.17"],"available":[{"date":"2016-12-13","kind":"advisory","version":"1.0.1ubuntu2.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-07","epss":0.07248,"percentile":0.94184}],"risk":5.436000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-1252"},"relatedVulnerabilities":[{"id":"CVE-2016-1252","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-07","epss":0.07248,"percentile":0.94184}],"urls":["http://packetstormsecurity.com/files/140145/apt-Repository-Signing-Bypass.html","http://www.ubuntu.com/usn/USN-3156-1","https://bugs.chromium.org/p/project-zero/issues/detail?id=1020","https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467","https://www.debian.org/security/2016/dsa-3733","https://www.exploit-db.com/exploits/40916/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1252","description":"The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures."}]},{"artifact":{"id":"23ab47d4e03730e8","cpes":["cpe:2.3:a:libapt-inst1.5:libapt-inst1.5:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt-inst1.5:libapt_inst1.5:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt_inst1.5:libapt-inst1.5:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt_inst1.5:libapt_inst1.5:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-inst1.5:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_inst1.5:1.0.1ubuntu2.14:*:*:*:*:*:*:*"],"name":"libapt-inst1.5","purl":"pkg:deb/ubuntu/libapt-inst1.5@1.0.1ubuntu2.14?arch=amd64&distro=ubuntu-14.04&upstream=apt","type":"deb","version":"1.0.1ubuntu2.14","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-inst1.5/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libapt-inst1.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-inst1.5:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libapt-inst1.5:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-1252","versionConstraint":"< 1.0.1ubuntu2.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.14"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-1252","fix":{"state":"fixed","versions":["1.0.1ubuntu2.17"],"available":[{"date":"2016-12-13","kind":"advisory","version":"1.0.1ubuntu2.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-07","epss":0.07248,"percentile":0.94184}],"risk":5.436000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-1252"},"relatedVulnerabilities":[{"id":"CVE-2016-1252","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-07","epss":0.07248,"percentile":0.94184}],"urls":["http://packetstormsecurity.com/files/140145/apt-Repository-Signing-Bypass.html","http://www.ubuntu.com/usn/USN-3156-1","https://bugs.chromium.org/p/project-zero/issues/detail?id=1020","https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467","https://www.debian.org/security/2016/dsa-3733","https://www.exploit-db.com/exploits/40916/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1252","description":"The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures."}]},{"artifact":{"id":"2ba1e871639e4832","cpes":["cpe:2.3:a:libapt-pkg4.12:libapt-pkg4.12:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt-pkg4.12:libapt_pkg4.12:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt-pkg4.12:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg4.12:libapt_pkg4.12:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-pkg4.12:1.0.1ubuntu2.14:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_pkg4.12:1.0.1ubuntu2.14:*:*:*:*:*:*:*"],"name":"libapt-pkg4.12","purl":"pkg:deb/ubuntu/libapt-pkg4.12@1.0.1ubuntu2.14?arch=amd64&distro=ubuntu-14.04&upstream=apt","type":"deb","version":"1.0.1ubuntu2.14","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-pkg4.12/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libapt-pkg4.12/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libapt-pkg4.12:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1ubuntu2.17"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-1252","versionConstraint":"< 1.0.1ubuntu2.17 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"apt","version":"1.0.1ubuntu2.14"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-1252","fix":{"state":"fixed","versions":["1.0.1ubuntu2.17"],"available":[{"date":"2016-12-13","kind":"advisory","version":"1.0.1ubuntu2.17"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-07","epss":0.07248,"percentile":0.94184}],"risk":5.436000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-1252"},"relatedVulnerabilities":[{"id":"CVE-2016-1252","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-1252","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-1252","date":"2026-10-07","epss":0.07248,"percentile":0.94184}],"urls":["http://packetstormsecurity.com/files/140145/apt-Repository-Signing-Bypass.html","http://www.ubuntu.com/usn/USN-3156-1","https://bugs.chromium.org/p/project-zero/issues/detail?id=1020","https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1647467","https://www.debian.org/security/2016/dsa-3733","https://www.exploit-db.com/exploits/40916/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1252","description":"The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubuntu 16.04 LTS before 1.2.15ubuntu0.2, and in Ubuntu 16.10 before 1.3.2ubuntu0.1 allows man-in-the-middle attackers to bypass a repository-signing protection mechanism by leveraging improper error handling when validating InRelease file signatures."}]},{"artifact":{"id":"71081c257357e0b6","cpes":["cpe:2.3:a:perl:perl:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6913","versionConstraint":"< 5.18.2-2ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-6913","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.4"],"available":[{"date":"2018-04-16","kind":"advisory","version":"5.18.2-2ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-07","epss":0.10668,"percentile":0.95699}],"risk":5.334,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-6913"},"relatedVulnerabilities":[{"id":"CVE-2018-6913","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-07","epss":0.10668,"percentile":0.95699}],"urls":["http://www.securityfocus.com/bid/103953","http://www.securitytracker.com/id/1040681","https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html","https://rt.perl.org/Public/Bug/Display.html?id=131844","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://usn.ubuntu.com/3625-2/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6913","description":"Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count."}]},{"artifact":{"id":"b6e547621bce8e70","cpes":["cpe:2.3:a:perl-base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6913","versionConstraint":"< 5.18.2-2ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-6913","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.4"],"available":[{"date":"2018-04-16","kind":"advisory","version":"5.18.2-2ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-07","epss":0.10668,"percentile":0.95699}],"risk":5.334,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-6913"},"relatedVulnerabilities":[{"id":"CVE-2018-6913","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-07","epss":0.10668,"percentile":0.95699}],"urls":["http://www.securityfocus.com/bid/103953","http://www.securitytracker.com/id/1040681","https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html","https://rt.perl.org/Public/Bug/Display.html?id=131844","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://usn.ubuntu.com/3625-2/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6913","description":"Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count."}]},{"artifact":{"id":"9a3f82ec97b0252b","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/ubuntu/perl-modules@5.18.2-2ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6913","versionConstraint":"< 5.18.2-2ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-6913","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.4"],"available":[{"date":"2018-04-16","kind":"advisory","version":"5.18.2-2ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-07","epss":0.10668,"percentile":0.95699}],"risk":5.334,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-6913"},"relatedVulnerabilities":[{"id":"CVE-2018-6913","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6913","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6913","date":"2026-10-07","epss":0.10668,"percentile":0.95699}],"urls":["http://www.securityfocus.com/bid/103953","http://www.securitytracker.com/id/1040681","https://lists.debian.org/debian-lts-announce/2018/04/msg00009.html","https://rt.perl.org/Public/Bug/Display.html?id=131844","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://usn.ubuntu.com/3625-2/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6913","description":"Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-1971","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-1971","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-1971","date":"2026-10-07","epss":0.07051,"percentile":0.94036}],"risk":5.28825,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-1971"},"relatedVulnerabilities":[{"id":"CVE-2020-1971","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-1971","date":"2026-10-07","epss":0.07051,"percentile":0.94036}],"urls":["http://www.openwall.com/lists/oss-security/2021/09/14/2","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676","https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html","https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/","https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc","https://security.gentoo.org/glsa/202012-13","https://security.netapp.com/advisory/ntap-20201218-0005/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2020/dsa-4807","https://www.openssl.org/news/secadv/20201208.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2020-11","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-1971","description":"The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-1971","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-1971","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-1971","date":"2026-10-07","epss":0.07051,"percentile":0.94036}],"risk":5.28825,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-1971"},"relatedVulnerabilities":[{"id":"CVE-2020-1971","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-1971","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-1971","date":"2026-10-07","epss":0.07051,"percentile":0.94036}],"urls":["http://www.openwall.com/lists/oss-security/2021/09/14/2","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676","https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E","https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html","https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/","https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc","https://security.gentoo.org/glsa/202012-13","https://security.netapp.com/advisory/ntap-20201218-0005/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://www.debian.org/security/2020/dsa-4807","https://www.openssl.org/news/secadv/20201208.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2020-11","https://www.tenable.com/security/tns-2021-09","https://www.tenable.com/security/tns-2021-10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-1971","description":"The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)."}]},{"artifact":{"id":"9f127744e4033e99","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.8.2-1ubuntu2.1?arch=amd64&distro=ubuntu-14.04&upstream=sqlite3","type":"deb","version":"3.8.2-1ubuntu2.1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20346","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sqlite3","version":"3.8.2-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-20346","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20346","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20346","date":"2026-10-07","epss":0.10312,"percentile":0.95594}],"risk":5.156000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20346"},"relatedVulnerabilities":[{"id":"CVE-2018-20346","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20346","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20346","date":"2026-10-07","epss":0.10312,"percentile":0.95594}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html","http://www.securityfocus.com/bid/106323","https://access.redhat.com/articles/3758321","https://blade.tencent.com/magellan/index_en.html","https://bugzilla.redhat.com/show_bug.cgi?id=1659379","https://bugzilla.redhat.com/show_bug.cgi?id=1659677","https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html","https://chromium.googlesource.com/chromium/src/+/c368e30ae55600a1c3c9cb1710a54f9c55de786e","https://crbug.com/900910","https://github.com/zhuowei/worthdoingbadly.com/blob/master/_posts/2018-12-14-sqlitebug.html","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2018/12/msg00012.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PU4NZ6DDU4BEM3ACM3FM6GLEPX56ZQXK/","https://news.ycombinator.com/item?id=18685296","https://security.gentoo.org/glsa/201904-21","https://sqlite.org/src/info/940f2adc8541a838","https://sqlite.org/src/info/d44318f59044162e","https://support.apple.com/HT209443","https://support.apple.com/HT209446","https://support.apple.com/HT209447","https://support.apple.com/HT209448","https://support.apple.com/HT209450","https://support.apple.com/HT209451","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://worthdoingbadly.com/sqlitebug/","https://www.freebsd.org/security/advisories/FreeBSD-EN-19:03.sqlite.asc","https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg113218.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.sqlite.org/releaselog/3_25_3.html","https://www.synology.com/security/advisory/Synology_SA_18_61"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20346","description":"SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan."}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-7183","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-7183","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.13"],"available":[{"date":"2018-07-09","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.13"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-7183","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7183","date":"2026-10-07","epss":0.10213,"percentile":0.95563}],"risk":5.1065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-7183"},"relatedVulnerabilities":[{"id":"CVE-2018-7183","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-7183","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-7183","date":"2026-10-07","epss":0.10213,"percentile":0.95563}],"urls":["http://support.ntp.org/bin/view/Main/NtpBug3414","http://support.ntp.org/bin/view/Main/SecurityNotice#February_2018_ntp_4_2_8p11_NTP_S","http://www.securityfocus.com/bid/103351","https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc","https://security.gentoo.org/glsa/201805-12","https://security.netapp.com/advisory/ntap-20180626-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us","https://usn.ubuntu.com/3707-1/","https://usn.ubuntu.com/3707-2/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.synology.com/support/security/Synology_SA_18_13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-7183","description":"Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2021","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2021","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"risk":5.006,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2021"},"relatedVulnerabilities":[{"id":"CVE-2021-2021","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:C","metrics":{"baseScore":6.8,"impactScore":6.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/","https://security.gentoo.org/glsa/202105-27","https://security.netapp.com/advisory/ntap-20210219-0003/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2021","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2021","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2021","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"risk":5.006,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2021"},"relatedVulnerabilities":[{"id":"CVE-2021-2021","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:C","metrics":{"baseScore":6.8,"impactScore":6.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/","https://security.gentoo.org/glsa/202105-27","https://security.netapp.com/advisory/ntap-20210219-0003/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2021","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2021","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2021","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"risk":5.006,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2021"},"relatedVulnerabilities":[{"id":"CVE-2021-2021","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:C","metrics":{"baseScore":6.8,"impactScore":6.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/","https://security.gentoo.org/glsa/202105-27","https://security.netapp.com/advisory/ntap-20210219-0003/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2021","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2021","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2021","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"risk":5.006,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2021"},"relatedVulnerabilities":[{"id":"CVE-2021-2021","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:C","metrics":{"baseScore":6.8,"impactScore":6.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/","https://security.gentoo.org/glsa/202105-27","https://security.netapp.com/advisory/ntap-20210219-0003/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2021","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2021","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2021","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"risk":5.006,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2021"},"relatedVulnerabilities":[{"id":"CVE-2021-2021","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:C","metrics":{"baseScore":6.8,"impactScore":6.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/","https://security.gentoo.org/glsa/202105-27","https://security.netapp.com/advisory/ntap-20210219-0003/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2021","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2021","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2021","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"risk":5.006,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2021"},"relatedVulnerabilities":[{"id":"CVE-2021-2021","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:C","metrics":{"baseScore":6.8,"impactScore":6.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/","https://security.gentoo.org/glsa/202105-27","https://security.netapp.com/advisory/ntap-20210219-0003/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2021","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2021","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2021","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"risk":5.006,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2021"},"relatedVulnerabilities":[{"id":"CVE-2021-2021","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:C","metrics":{"baseScore":6.8,"impactScore":6.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2021","date":"2026-10-07","epss":0.10012,"percentile":0.95503}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CS5THZSGI7O2CZO44NWYE57AG2T7NK3K/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T7EAHJPWOOF4D6PEFLXW5IQWRRSZ3HRC/","https://security.gentoo.org/glsa/202105-27","https://security.netapp.com/advisory/ntap-20210219-0003/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2021","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.22 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-7978","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-7978","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"],"available":[{"date":"2016-10-05","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-7978","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7978","date":"2026-10-07","epss":0.09985,"percentile":0.95494}],"risk":4.9925,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-7978"},"relatedVulnerabilities":[{"id":"CVE-2015-7978","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-7978","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7978","date":"2026-10-07","epss":0.09985,"percentile":0.95494}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176434.html","http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html","http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html","http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html","http://rhn.redhat.com/errata/RHSA-2016-0780.html","http://rhn.redhat.com/errata/RHSA-2016-2583.html","http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd","http://www.debian.org/security/2016/dsa-3629","http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","http://www.securityfocus.com/bid/81962","http://www.securitytracker.com/id/1034782","http://www.ubuntu.com/usn/USN-3096-1","https://bto.bluecoat.com/security-advisory/sa113","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc","https://security.gentoo.org/glsa/201607-15","https://security.netapp.com/advisory/ntap-20171031-0001/","https://www.kb.cert.org/vuls/id/718152"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-7978","description":"NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5699","versionConstraint":"< 3.4.3-1ubuntu1~14.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5699","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.5"],"available":[{"date":"2016-11-22","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5699","cwe":"CWE-113","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5699","date":"2026-10-07","epss":0.09887,"percentile":0.95461}],"risk":4.9435,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5699"},"relatedVulnerabilities":[{"id":"CVE-2016-5699","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5699","cwe":"CWE-113","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5699","date":"2026-10-07","epss":0.09887,"percentile":0.95461}],"urls":["http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://rhn.redhat.com/errata/RHSA-2016-1626.html","http://rhn.redhat.com/errata/RHSA-2016-1627.html","http://rhn.redhat.com/errata/RHSA-2016-1628.html","http://rhn.redhat.com/errata/RHSA-2016-1629.html","http://rhn.redhat.com/errata/RHSA-2016-1630.html","http://www.openwall.com/lists/oss-security/2016/06/14/7","http://www.openwall.com/lists/oss-security/2016/06/15/12","http://www.openwall.com/lists/oss-security/2016/06/16/2","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91226","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4","https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS","https://hg.python.org/cpython/rev/1c45047c5102","https://hg.python.org/cpython/rev/bf3e1c9b80e9","https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5699","description":"CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5699","versionConstraint":"< 3.4.3-1ubuntu1~14.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5699","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.5"],"available":[{"date":"2016-11-22","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5699","cwe":"CWE-113","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5699","date":"2026-10-07","epss":0.09887,"percentile":0.95461}],"risk":4.9435,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5699"},"relatedVulnerabilities":[{"id":"CVE-2016-5699","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5699","cwe":"CWE-113","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5699","date":"2026-10-07","epss":0.09887,"percentile":0.95461}],"urls":["http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://rhn.redhat.com/errata/RHSA-2016-1626.html","http://rhn.redhat.com/errata/RHSA-2016-1627.html","http://rhn.redhat.com/errata/RHSA-2016-1628.html","http://rhn.redhat.com/errata/RHSA-2016-1629.html","http://rhn.redhat.com/errata/RHSA-2016-1630.html","http://www.openwall.com/lists/oss-security/2016/06/14/7","http://www.openwall.com/lists/oss-security/2016/06/15/12","http://www.openwall.com/lists/oss-security/2016/06/16/2","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91226","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4","https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS","https://hg.python.org/cpython/rev/1c45047c5102","https://hg.python.org/cpython/rev/bf3e1c9b80e9","https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5699","description":"CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-5699","versionConstraint":"< 3.4.3-1ubuntu1~14.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5699","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.5"],"available":[{"date":"2016-11-22","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5699","cwe":"CWE-113","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5699","date":"2026-10-07","epss":0.09887,"percentile":0.95461}],"risk":4.9435,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5699"},"relatedVulnerabilities":[{"id":"CVE-2016-5699","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5699","cwe":"CWE-113","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5699","date":"2026-10-07","epss":0.09887,"percentile":0.95461}],"urls":["http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://rhn.redhat.com/errata/RHSA-2016-1626.html","http://rhn.redhat.com/errata/RHSA-2016-1627.html","http://rhn.redhat.com/errata/RHSA-2016-1628.html","http://rhn.redhat.com/errata/RHSA-2016-1629.html","http://rhn.redhat.com/errata/RHSA-2016-1630.html","http://www.openwall.com/lists/oss-security/2016/06/14/7","http://www.openwall.com/lists/oss-security/2016/06/15/12","http://www.openwall.com/lists/oss-security/2016/06/16/2","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91226","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4","https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS","https://hg.python.org/cpython/rev/1c45047c5102","https://hg.python.org/cpython/rev/bf3e1c9b80e9","https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5699","description":"CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5699","versionConstraint":"< 3.4.3-1ubuntu1~14.04.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5699","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.5"],"available":[{"date":"2016-11-22","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5699","cwe":"CWE-113","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5699","date":"2026-10-07","epss":0.09887,"percentile":0.95461}],"risk":4.9435,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5699"},"relatedVulnerabilities":[{"id":"CVE-2016-5699","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5699","cwe":"CWE-113","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5699","date":"2026-10-07","epss":0.09887,"percentile":0.95461}],"urls":["http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://rhn.redhat.com/errata/RHSA-2016-1626.html","http://rhn.redhat.com/errata/RHSA-2016-1627.html","http://rhn.redhat.com/errata/RHSA-2016-1628.html","http://rhn.redhat.com/errata/RHSA-2016-1629.html","http://rhn.redhat.com/errata/RHSA-2016-1630.html","http://www.openwall.com/lists/oss-security/2016/06/14/7","http://www.openwall.com/lists/oss-security/2016/06/15/12","http://www.openwall.com/lists/oss-security/2016/06/16/2","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91226","http://www.splunk.com/view/SP-CAAAPSV","http://www.splunk.com/view/SP-CAAAPUE","https://docs.python.org/3.4/whatsnew/changelog.html#python-3-4-4","https://hg.python.org/cpython/raw-file/v2.7.10/Misc/NEWS","https://hg.python.org/cpython/rev/1c45047c5102","https://hg.python.org/cpython/rev/bf3e1c9b80e9","https://lists.debian.org/debian-lts-announce/2019/02/msg00011.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5699","description":"CRLF injection vulnerability in the HTTPConnection.putheader function in urllib2 and urllib in CPython (aka Python) before 2.7.10 and 3.x before 3.4.4 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in a URL."}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-4956","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-4956","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"],"available":[{"date":"2016-10-05","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"}]},"cvss":[],"epss":[{"cve":"CVE-2016-4956","date":"2026-10-07","epss":0.16351,"percentile":0.9689}],"risk":4.9052999999999995,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-4956"},"relatedVulnerabilities":[{"id":"CVE-2016-4956","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-4956","date":"2026-10-07","epss":0.16351,"percentile":0.9689}],"urls":["http://bugs.ntp.org/3042","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html","http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html","http://packetstormsecurity.com/files/137321/Slackware-Security-Advisory-ntp-Updates.html","http://support.ntp.org/bin/view/Main/NtpBug3042","http://support.ntp.org/bin/view/Main/SecurityNotice","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160603-ntpd","http://www.kb.cert.org/vuls/id/321640","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.securityfocus.com/archive/1/538599/100/0/threaded","http://www.securityfocus.com/archive/1/538600/100/0/threaded","http://www.securityfocus.com/archive/1/540683/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/538599/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/538600/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/540683/100/0/threaded","http://www.securityfocus.com/bid/91009","http://www.securitytracker.com/id/1036037","http://www.ubuntu.com/usn/USN-3096-1","https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03757en_us","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3EYJQHJZ2KTVQ7ICEFHXTLZ36MRASWX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORAMN3Q7TVJ54MBYF75XCJOE3DP7LYHT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNWGCQLW2VY72NIUYMJOCAKJKTXHDUK2/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:24.ntp.asc","https://security.gentoo.org/glsa/201607-15","https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11","https://www.kb.cert.org/vuls/id/321640"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4956","description":"ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-8285","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-8285","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-10-07","epss":0.0977,"percentile":0.95421}],"risk":4.885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-8285"},"relatedVulnerabilities":[{"id":"CVE-2020-8285","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-10-07","epss":0.0977,"percentile":0.95421}],"urls":["http://seclists.org/fulldisclosure/2021/Apr/51","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2020-8285.html","https://github.com/curl/curl/issues/6255","https://hackerone.com/reports/1045844","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","https://security.gentoo.org/glsa/202012-14","https://security.netapp.com/advisory/ntap-20210122-0007/","https://support.apple.com/kb/HT212325","https://support.apple.com/kb/HT212326","https://support.apple.com/kb/HT212327","https://www.debian.org/security/2021/dsa-4881","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8285","description":"curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8285","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-8285","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-10-07","epss":0.0977,"percentile":0.95421}],"risk":4.885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-8285"},"relatedVulnerabilities":[{"id":"CVE-2020-8285","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-10-07","epss":0.0977,"percentile":0.95421}],"urls":["http://seclists.org/fulldisclosure/2021/Apr/51","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2020-8285.html","https://github.com/curl/curl/issues/6255","https://hackerone.com/reports/1045844","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","https://security.gentoo.org/glsa/202012-14","https://security.netapp.com/advisory/ntap-20210122-0007/","https://support.apple.com/kb/HT212325","https://support.apple.com/kb/HT212326","https://support.apple.com/kb/HT212327","https://www.debian.org/security/2021/dsa-4881","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8285","description":"curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-8285","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-8285","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-10-07","epss":0.0977,"percentile":0.95421}],"risk":4.885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-8285"},"relatedVulnerabilities":[{"id":"CVE-2020-8285","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2020-8285","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-8285","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-8285","date":"2026-10-07","epss":0.0977,"percentile":0.95421}],"urls":["http://seclists.org/fulldisclosure/2021/Apr/51","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://curl.se/docs/CVE-2020-8285.html","https://github.com/curl/curl/issues/6255","https://hackerone.com/reports/1045844","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/","https://security.gentoo.org/glsa/202012-14","https://security.netapp.com/advisory/ntap-20210122-0007/","https://support.apple.com/kb/HT212325","https://support.apple.com/kb/HT212326","https://support.apple.com/kb/HT212327","https://www.debian.org/security/2021/dsa-4881","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8285","description":"curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing."}]},{"artifact":{"id":"71081c257357e0b6","cpes":["cpe:2.3:a:perl:perl:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.7"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-18313","versionConstraint":"< 5.18.2-2ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18313","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.7"],"available":[{"date":"2018-12-03","kind":"advisory","version":"5.18.2-2ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18313","date":"2026-10-07","epss":0.09524,"percentile":0.95335}],"risk":4.7620000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18313"},"relatedVulnerabilities":[{"id":"CVE-2018-18313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18313","date":"2026-10-07","epss":0.09524,"percentile":0.95335}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://bugzilla.redhat.com/show_bug.cgi?id=1646738","https://github.com/Perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://rt.perl.org/Ticket/Display.html?id=133192","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18313","description":"Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory."}]},{"artifact":{"id":"b6e547621bce8e70","cpes":["cpe:2.3:a:perl-base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18313","versionConstraint":"< 5.18.2-2ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18313","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.7"],"available":[{"date":"2018-12-03","kind":"advisory","version":"5.18.2-2ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18313","date":"2026-10-07","epss":0.09524,"percentile":0.95335}],"risk":4.7620000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18313"},"relatedVulnerabilities":[{"id":"CVE-2018-18313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18313","date":"2026-10-07","epss":0.09524,"percentile":0.95335}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://bugzilla.redhat.com/show_bug.cgi?id=1646738","https://github.com/Perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://rt.perl.org/Ticket/Display.html?id=133192","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18313","description":"Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory."}]},{"artifact":{"id":"9a3f82ec97b0252b","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/ubuntu/perl-modules@5.18.2-2ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.7"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-18313","versionConstraint":"< 5.18.2-2ubuntu1.7 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-18313","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.7"],"available":[{"date":"2018-12-03","kind":"advisory","version":"5.18.2-2ubuntu1.7"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-18313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18313","date":"2026-10-07","epss":0.09524,"percentile":0.95335}],"risk":4.7620000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-18313"},"relatedVulnerabilities":[{"id":"CVE-2018-18313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-18313","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-18313","date":"2026-10-07","epss":0.09524,"percentile":0.95335}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securitytracker.com/id/1042181","https://access.redhat.com/errata/RHSA-2019:0001","https://access.redhat.com/errata/RHSA-2019:0010","https://bugzilla.redhat.com/show_bug.cgi?id=1646738","https://github.com/Perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","https://metacpan.org/changes/release/SHAY/perl-5.26.3","https://rt.perl.org/Ticket/Display.html?id=133192","https://seclists.org/bugtraq/2019/Mar/42","https://security.gentoo.org/glsa/201909-01","https://security.netapp.com/advisory/ntap-20190221-0003/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3834-1/","https://usn.ubuntu.com/3834-2/","https://www.debian.org/security/2018/dsa-4347","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-18313","description":"Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory."}]},{"artifact":{"id":"3695a31b2933dc8f","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10708","versionConstraint":"< 1:6.6p1-2ubuntu2.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-10708","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.11"],"available":[{"date":"2018-11-06","kind":"advisory","version":"1:6.6p1-2ubuntu2.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10708","date":"2026-10-07","epss":0.15716,"percentile":0.96779}],"risk":4.714799999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-10708"},"relatedVulnerabilities":[{"id":"CVE-2016-10708","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10708","date":"2026-10-07","epss":0.15716,"percentile":0.96779}],"urls":["http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html","http://www.securityfocus.com/bid/102780","https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737","https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf","https://kc.mcafee.com/corporate/index?page=content&id=SB10284","https://lists.debian.org/debian-lts-announce/2018/01/msg00031.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","https://security.netapp.com/advisory/ntap-20180423-0003/","https://support.f5.com/csp/article/K32485746?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3809-1/","https://www.openssh.com/releasenotes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10708","description":"sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c."}]},{"artifact":{"id":"54d7c6e40533c708","cpes":["cpe:2.3:a:openssh-server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-server","purl":"pkg:deb/ubuntu/openssh-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.config","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.config"},{"path":"/var/lib/dpkg/info/openssh-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.list"},{"path":"/var/lib/dpkg/info/openssh-server.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postinst"},{"path":"/var/lib/dpkg/info/openssh-server.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postrm"},{"path":"/var/lib/dpkg/info/openssh-server.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.preinst"},{"path":"/var/lib/dpkg/info/openssh-server.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.prerm"},{"path":"/var/lib/dpkg/info/openssh-server.templates","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.templates"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10708","versionConstraint":"< 1:6.6p1-2ubuntu2.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-10708","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.11"],"available":[{"date":"2018-11-06","kind":"advisory","version":"1:6.6p1-2ubuntu2.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10708","date":"2026-10-07","epss":0.15716,"percentile":0.96779}],"risk":4.714799999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-10708"},"relatedVulnerabilities":[{"id":"CVE-2016-10708","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10708","date":"2026-10-07","epss":0.15716,"percentile":0.96779}],"urls":["http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html","http://www.securityfocus.com/bid/102780","https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737","https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf","https://kc.mcafee.com/corporate/index?page=content&id=SB10284","https://lists.debian.org/debian-lts-announce/2018/01/msg00031.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","https://security.netapp.com/advisory/ntap-20180423-0003/","https://support.f5.com/csp/article/K32485746?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3809-1/","https://www.openssh.com/releasenotes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10708","description":"sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c."}]},{"artifact":{"id":"b3db4be88de03e2f","cpes":["cpe:2.3:a:openssh-sftp-server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp-server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-sftp-server","purl":"pkg:deb/ubuntu/openssh-sftp-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-sftp-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.list"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:6.6p1-2ubuntu2.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-10708","versionConstraint":"< 1:6.6p1-2ubuntu2.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-10708","fix":{"state":"fixed","versions":["1:6.6p1-2ubuntu2.11"],"available":[{"date":"2018-11-06","kind":"advisory","version":"1:6.6p1-2ubuntu2.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10708","date":"2026-10-07","epss":0.15716,"percentile":0.96779}],"risk":4.714799999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-10708"},"relatedVulnerabilities":[{"id":"CVE-2016-10708","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-10708","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-10708","date":"2026-10-07","epss":0.15716,"percentile":0.96779}],"urls":["http://blog.swiecki.net/2018/01/fuzzing-tcp-servers.html","http://www.securityfocus.com/bid/102780","https://anongit.mindrot.org/openssh.git/commit/?id=28652bca29046f62c7045e933e6b931de1d16737","https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf","https://kc.mcafee.com/corporate/index?page=content&id=SB10284","https://lists.debian.org/debian-lts-announce/2018/01/msg00031.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","https://security.netapp.com/advisory/ntap-20180423-0003/","https://support.f5.com/csp/article/K32485746?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/3809-1/","https://www.openssh.com/releasenotes.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-10708","description":"sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c."}]},{"artifact":{"id":"91e22e3289c39d88","cpes":["cpe:2.3:a:bzip2:bzip2:1.0.6-5:*:*:*:*:*:*:*"],"name":"bzip2","purl":"pkg:deb/ubuntu/bzip2@1.0.6-5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.6-5","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bzip2/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/bzip2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bzip2.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/bzip2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bzip2.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/bzip2.list"},{"path":"/var/lib/dpkg/info/bzip2.preinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/bzip2.preinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-3189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"bzip2","version":"1.0.6-5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-10-07","epss":0.15562,"percentile":0.96751}],"risk":4.6686,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3189"},"relatedVulnerabilities":[{"id":"CVE-2016-3189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-10-07","epss":0.15562,"percentile":0.96751}],"urls":["http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","http://www.openwall.com/lists/oss-security/2016/06/20/1","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91297","http://www.securitytracker.com/id/1036132","https://bugzilla.redhat.com/show_bug.cgi?id=1319648","https://lists.apache.org/thread.html/r19b4a70ac52093115fd71d773a7a4f579599e6275a13cfcf6252c3e3%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r1dc4c9b3bd559301bdb1557245f78b8910146efb1ee534b774c5f6af%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r481cda41fefb03e04c51484ed14421d812e5ce9e0972edff10f37260%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r4ad2ea01354e394b7fa8c78a184b7e1634d51be9bc0e9e4d7e6c9305%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f7ac2bd631ccb12ced65b71ff11f94e76d05b22000795e4a7b61203%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f80cf3ade5bb73410643e885fe6b7bf9f0222daf3533e42c7ae240c%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6e3962fc9f6a79851f70cffdec5759065969cec9c6708b964464b301%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/redf17d8ad16140733b25ca402ae825d6dfa9b85f73d9fb3fd0c75d73%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rffebcbeaace56ff1fed7916700d2f414ca1366386fb1293e99b3e31e%40%3Cjira.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://security.gentoo.org/glsa/201708-08","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block."}]},{"artifact":{"id":"f59d1e0c17b85413","cpes":["cpe:2.3:a:libbz2-1.0:libbz2-1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2-1.0:libbz2_1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2-1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2_1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2-1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2_1.0:1.0.6-5:*:*:*:*:*:*:*"],"name":"libbz2-1.0","purl":"pkg:deb/ubuntu/libbz2-1.0@1.0.6-5?arch=amd64&distro=ubuntu-14.04&upstream=bzip2","type":"deb","version":"1.0.6-5","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbz2-1.0/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/libbz2-1.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"bzip2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-3189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"bzip2","version":"1.0.6-5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-3189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-10-07","epss":0.15562,"percentile":0.96751}],"risk":4.6686,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-3189"},"relatedVulnerabilities":[{"id":"CVE-2016-3189","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-3189","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-3189","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-3189","date":"2026-10-07","epss":0.15562,"percentile":0.96751}],"urls":["http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","http://www.openwall.com/lists/oss-security/2016/06/20/1","http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html","http://www.securityfocus.com/bid/91297","http://www.securitytracker.com/id/1036132","https://bugzilla.redhat.com/show_bug.cgi?id=1319648","https://lists.apache.org/thread.html/r19b4a70ac52093115fd71d773a7a4f579599e6275a13cfcf6252c3e3%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r1dc4c9b3bd559301bdb1557245f78b8910146efb1ee534b774c5f6af%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r481cda41fefb03e04c51484ed14421d812e5ce9e0972edff10f37260%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r4ad2ea01354e394b7fa8c78a184b7e1634d51be9bc0e9e4d7e6c9305%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f7ac2bd631ccb12ced65b71ff11f94e76d05b22000795e4a7b61203%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r5f80cf3ade5bb73410643e885fe6b7bf9f0222daf3533e42c7ae240c%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/r6e3962fc9f6a79851f70cffdec5759065969cec9c6708b964464b301%40%3Cjira.kafka.apache.org%3E","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/redf17d8ad16140733b25ca402ae825d6dfa9b85f73d9fb3fd0c75d73%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rffebcbeaace56ff1fed7916700d2f414ca1366386fb1293e99b3e31e%40%3Cjira.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://security.gentoo.org/glsa/201708-08","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-3189","description":"Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000121","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000121","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-07","epss":0.09205,"percentile":0.95218}],"risk":4.6025,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000121"},"relatedVulnerabilities":[{"id":"CVE-2018-1000121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-07","epss":0.09205,"percentile":0.95218}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103415","http://www.securitytracker.com/id/1040529","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-97a2.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000121","description":"A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service"}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000121","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000121","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-07","epss":0.09205,"percentile":0.95218}],"risk":4.6025,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000121"},"relatedVulnerabilities":[{"id":"CVE-2018-1000121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-07","epss":0.09205,"percentile":0.95218}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103415","http://www.securitytracker.com/id/1040529","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-97a2.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000121","description":"A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service"}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000121","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000121","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-07","epss":0.09205,"percentile":0.95218}],"risk":4.6025,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000121"},"relatedVulnerabilities":[{"id":"CVE-2018-1000121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000121","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000121","date":"2026-10-07","epss":0.09205,"percentile":0.95218}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103415","http://www.securitytracker.com/id/1040529","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-97a2.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000121","description":"A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service"}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2518","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2518","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"],"available":[{"date":"2016-10-05","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2518","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2518","date":"2026-10-07","epss":0.15081,"percentile":0.96652}],"risk":4.5243,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2518"},"relatedVulnerabilities":[{"id":"CVE-2016-2518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2518","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2518","date":"2026-10-07","epss":0.15081,"percentile":0.96652}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183647.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184669.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00034.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00052.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00001.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html","http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html","http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html","http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html","http://packetstormsecurity.com/files/136864/Slackware-Security-Advisory-ntp-Updates.html","http://rhn.redhat.com/errata/RHSA-2016-1552.html","http://support.ntp.org/bin/view/Main/NtpBug3009","http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_ntp_4_2_8p7_Security","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160428-ntpd","http://www.debian.org/security/2016/dsa-3629","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","http://www.securityfocus.com/archive/1/538233/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/538233/100/0/threaded","http://www.securityfocus.com/bid/88226","http://www.securitytracker.com/id/1035705","http://www.ubuntu.com/usn/USN-3096-1","https://access.redhat.com/errata/RHSA-2016:1141","https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc","https://security.gentoo.org/glsa/201607-15","https://security.netapp.com/advisory/ntap-20171004-0002/","https://support.f5.com/csp/article/K20804323","https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11","https://www.debian.org/security/2016/dsa-3629","https://www.kb.cert.org/vuls/id/718152"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2518","description":"The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000122","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000122","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-07","epss":0.09039,"percentile":0.95162}],"risk":4.5195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000122"},"relatedVulnerabilities":[{"id":"CVE-2018-1000122","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-07","epss":0.09039,"percentile":0.95162}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103436","http://www.securitytracker.com/id/1040530","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b047.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000122","description":"A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage"}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000122","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000122","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-07","epss":0.09039,"percentile":0.95162}],"risk":4.5195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000122"},"relatedVulnerabilities":[{"id":"CVE-2018-1000122","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-07","epss":0.09039,"percentile":0.95162}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103436","http://www.securitytracker.com/id/1040530","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b047.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000122","description":"A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage"}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000122","versionConstraint":"< 7.35.0-1ubuntu2.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000122","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.15"],"available":[{"date":"2018-03-15","kind":"advisory","version":"7.35.0-1ubuntu2.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-07","epss":0.09039,"percentile":0.95162}],"risk":4.5195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000122"},"relatedVulnerabilities":[{"id":"CVE-2018-1000122","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000122","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1000122","date":"2026-10-07","epss":0.09039,"percentile":0.95162}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103436","http://www.securitytracker.com/id/1040530","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b047.html","https://lists.debian.org/debian-lts-announce/2018/03/msg00012.html","https://usn.ubuntu.com/3598-1/","https://usn.ubuntu.com/3598-2/","https://www.debian.org/security/2018/dsa-4136","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000122","description":"A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage"}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-2516","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-2516","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"],"available":[{"date":"2016-10-05","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-2516","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2516","date":"2026-10-07","epss":0.08948,"percentile":0.95126}],"risk":4.474,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2516"},"relatedVulnerabilities":[{"id":"CVE-2016-2516","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2516","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-2516","date":"2026-10-07","epss":0.08948,"percentile":0.95126}],"urls":["http://support.ntp.org/bin/view/Main/NtpBug3011","http://www.debian.org/security/2016/dsa-3629","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.securityfocus.com/bid/88180","http://www.securitytracker.com/id/1035705","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:16.ntp.asc","https://security.gentoo.org/glsa/201607-15","https://security.netapp.com/advisory/ntap-20171004-0002/","https://www.kb.cert.org/vuls/id/718152"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2516","description":"NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP address multiple times in an unconfig directive."}]},{"artifact":{"id":"a55d04cf1fee804c","cpes":["cpe:2.3:a:libprocps3:libprocps3:1\\:3.3.9-1ubuntu2.2:*:*:*:*:*:*:*"],"name":"libprocps3","purl":"pkg:deb/ubuntu/libprocps3@1%3A3.3.9-1ubuntu2.2?arch=amd64&distro=ubuntu-14.04&upstream=procps","type":"deb","version":"1:3.3.9-1ubuntu2.2","language":"","licenses":["sha256:030b4251d06b344fa561a6c54a861d9600984b7464bcdeeed72cafcbae9ce73c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libprocps3/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/libprocps3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libprocps3:amd64.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/libprocps3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"procps"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:3.3.9-1ubuntu2.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1123","versionConstraint":"< 1:3.3.9-1ubuntu2.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"procps","version":"1:3.3.9-1ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1123","fix":{"state":"fixed","versions":["1:3.3.9-1ubuntu2.3"],"available":[{"date":"2018-05-23","kind":"advisory","version":"1:3.3.9-1ubuntu2.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-10-07","epss":0.08902,"percentile":0.95109}],"risk":4.4510000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1123"},"relatedVulnerabilities":[{"id":"CVE-2018-1123","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-10-07","epss":0.08902,"percentile":0.95109}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html","http://seclists.org/oss-sec/2018/q2/122","http://www.securityfocus.com/bid/104214","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html","https://security.gentoo.org/glsa/201805-14","https://usn.ubuntu.com/3658-1/","https://usn.ubuntu.com/3658-3/","https://www.debian.org/security/2018/dsa-4208","https://www.exploit-db.com/exploits/44806/","https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1123","description":"procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service)."}]},{"artifact":{"id":"5dca10c0e73a9ccd","cpes":["cpe:2.3:a:procps:procps:1\\:3.3.9-1ubuntu2.2:*:*:*:*:*:*:*"],"name":"procps","purl":"pkg:deb/ubuntu/procps@1%3A3.3.9-1ubuntu2.2?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1:3.3.9-1ubuntu2.2","language":"","licenses":["sha256:030b4251d06b344fa561a6c54a861d9600984b7464bcdeeed72cafcbae9ce73c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/procps/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/procps/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.conffiles","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/procps.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/procps.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/procps.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/procps.list"},{"path":"/var/lib/dpkg/info/procps.postinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/procps.postinst"},{"path":"/var/lib/dpkg/info/procps.postrm","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/procps.postrm"},{"path":"/var/lib/dpkg/info/procps.preinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/procps.preinst"},{"path":"/var/lib/dpkg/info/procps.prerm","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/procps.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:3.3.9-1ubuntu2.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1123","versionConstraint":"< 1:3.3.9-1ubuntu2.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"procps","version":"1:3.3.9-1ubuntu2.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1123","fix":{"state":"fixed","versions":["1:3.3.9-1ubuntu2.3"],"available":[{"date":"2018-05-23","kind":"advisory","version":"1:3.3.9-1ubuntu2.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-10-07","epss":0.08902,"percentile":0.95109}],"risk":4.4510000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1123"},"relatedVulnerabilities":[{"id":"CVE-2018-1123","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":3.9,"impactScore":2.6,"exploitabilityScore":1.4},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1123","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1123","cwe":"CWE-119","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1123","date":"2026-10-07","epss":0.08902,"percentile":0.95109}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00058.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00059.html","http://seclists.org/oss-sec/2018/q2/122","http://www.securityfocus.com/bid/104214","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1123","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/05/msg00021.html","https://security.gentoo.org/glsa/201805-14","https://usn.ubuntu.com/3658-1/","https://usn.ubuntu.com/3658-3/","https://www.debian.org/security/2018/dsa-4208","https://www.exploit-db.com/exploits/44806/","https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1123","description":"procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection in ps maps a guard page at the end of the overflowed buffer, ensuring that the impact of this flaw is limited to a crash (temporary denial of service)."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-10-07","epss":0.08811,"percentile":0.95062}],"risk":4.4055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9636"},"relatedVulnerabilities":[{"id":"CVE-2019-9636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-10-07","epss":0.08811,"percentile":0.95062}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-10-07","epss":0.08811,"percentile":0.95062}],"risk":4.4055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9636"},"relatedVulnerabilities":[{"id":"CVE-2019-9636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-10-07","epss":0.08811,"percentile":0.95062}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-9636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-10-07","epss":0.08811,"percentile":0.95062}],"risk":4.4055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9636"},"relatedVulnerabilities":[{"id":"CVE-2019-9636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-10-07","epss":0.08811,"percentile":0.95062}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9636","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9636","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-10-07","epss":0.08811,"percentile":0.95062}],"risk":4.4055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9636"},"relatedVulnerabilities":[{"id":"CVE-2019-9636","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9636","cwe":"CWE-173","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9636","date":"2026-10-07","epss":0.08811,"percentile":0.95062}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00092.html","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00097.html","http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00042.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://www.securityfocus.com/bid/107400","https://access.redhat.com/errata/RHBA-2019:0763","https://access.redhat.com/errata/RHBA-2019:0764","https://access.redhat.com/errata/RHBA-2019:0959","https://access.redhat.com/errata/RHSA-2019:0710","https://access.redhat.com/errata/RHSA-2019:0765","https://access.redhat.com/errata/RHSA-2019:0806","https://access.redhat.com/errata/RHSA-2019:0902","https://access.redhat.com/errata/RHSA-2019:0981","https://access.redhat.com/errata/RHSA-2019:0997","https://access.redhat.com/errata/RHSA-2019:1467","https://access.redhat.com/errata/RHSA-2019:2980","https://access.redhat.com/errata/RHSA-2019:3170","https://bugs.python.org/issue36216","https://github.com/python/cpython/pull/12201","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46PVWY5LFP4BRPG3BVQ5QEEFYBVEXHCK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AEZ5IQT7OF7Q2NCGIVABOWYGKO7YU3NJ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CFBAAGM27H73OLYBUA2IAZFSUN6KGLME/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D3LXPABKVLFYUHRYJPM3CSS5MS6FXKS7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HQEQLXLOCR3SNM3AA5RRYJFQ5AZBYJ4L/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICBEGRHIPHWPG2VGYS6R4EVKVUUF4AQW/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFAXBEY2TGOBDRKTR556JBXBVFSAKD6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSKPGPZQNTAULHW4UH63KGOOUIDE4RRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRYFIMISZ47NTAU3XWZUOFB7CYL62KES/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L25RTMKCF62DLC2XVSNXGX7C7HXISLVM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TR6GCO3WTV4D5L23WTCBF275VE6BVNI3/","https://python-security.readthedocs.io/vuln/urlsplit-nfkc-normalization.html","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190517-0001/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9636","description":"Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"df1837354f8ead15","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.1.0-4ubuntu1.3?arch=amd64&distro=ubuntu-14.04&upstream=expat","type":"deb","version":"2.1.0-4ubuntu1.3","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.1.0-4ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-9233","versionConstraint":"< 2.1.0-4ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"expat","version":"2.1.0-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-9233","fix":{"state":"fixed","versions":["2.1.0-4ubuntu1.4"],"available":[{"date":"2017-07-19","kind":"advisory","version":"2.1.0-4ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-9233","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-9233","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9233","date":"2026-10-07","epss":0.08739,"percentile":0.9503}],"risk":4.3694999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-9233"},"relatedVulnerabilities":[{"id":"CVE-2017-9233","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9233","cwe":"CWE-611","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-9233","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9233","date":"2026-10-07","epss":0.08739,"percentile":0.9503}],"urls":["http://www.debian.org/security/2017/dsa-3898","http://www.openwall.com/lists/oss-security/2017/06/17/7","http://www.securityfocus.com/bid/99276","http://www.securitytracker.com/id/1039427","https://github.com/libexpat/libexpat/blob/master/expat/Changes","https://libexpat.github.io/doc/cve-2017-9233/","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://support.apple.com/HT208112","https://support.apple.com/HT208113","https://support.apple.com/HT208115","https://support.apple.com/HT208144","https://support.f5.com/csp/article/K03244804"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9233","description":"XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD."}]},{"artifact":{"id":"57604ba6c5c65d28","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-3ubuntu4.8:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/ubuntu/libxml2@2.9.1%2Bdfsg1-3ubuntu4.8?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.9.1+dfsg1-3ubuntu4.8","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.9.1+dfsg1-3ubuntu4.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-4658","versionConstraint":"< 2.9.1+dfsg1-3ubuntu4.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-3ubuntu4.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-4658","fix":{"state":"fixed","versions":["2.9.1+dfsg1-3ubuntu4.9"],"available":[{"date":"2017-03-16","kind":"advisory","version":"2.9.1+dfsg1-3ubuntu4.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-4658","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4658","date":"2026-10-07","epss":0.08559,"percentile":0.94936}],"risk":4.2795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-4658"},"relatedVulnerabilities":[{"id":"CVE-2016-4658","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","metrics":{"baseScore":10,"impactScore":10.1,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4658","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4658","date":"2026-10-07","epss":0.08559,"percentile":0.94936}],"urls":["http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html","http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html","http://lists.apple.com/archives/security-announce/2016/Sep/msg00010.html","http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html","http://www.securityfocus.com/bid/93054","http://www.securitytracker.com/id/1036858","http://www.securitytracker.com/id/1038623","https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b","https://security.gentoo.org/glsa/201701-37","https://support.apple.com/HT207141","https://support.apple.com/HT207142","https://support.apple.com/HT207143","https://support.apple.com/HT207170"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4658","description":"xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document."}]},{"artifact":{"id":"54f09b094723dd7d","cpes":["cpe:2.3:a:gnupg:gnupg:1.4.16-1ubuntu2.3:*:*:*:*:*:*:*"],"name":"gnupg","purl":"pkg:deb/ubuntu/gnupg@1.4.16-1ubuntu2.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.4.16-1ubuntu2.3","language":"","licenses":["GPL-3","GPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/gnupg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/gnupg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/gnupg.list"},{"path":"/var/lib/dpkg/info/gnupg.postinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/gnupg.postinst"},{"path":"/var/lib/dpkg/info/gnupg.preinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/gnupg.preinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.16-1ubuntu2.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-12020","versionConstraint":"< 1.4.16-1ubuntu2.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnupg","version":"1.4.16-1ubuntu2.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12020","fix":{"state":"fixed","versions":["1.4.16-1ubuntu2.5"],"available":[{"date":"2018-06-11","kind":"advisory","version":"1.4.16-1ubuntu2.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-10-07","epss":0.08546,"percentile":0.94931}],"risk":4.273,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12020"},"relatedVulnerabilities":[{"id":"CVE-2018-12020","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-10-07","epss":0.08546,"percentile":0.94931}],"urls":["http://openwall.com/lists/oss-security/2018/06/08/2","http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html","http://seclists.org/fulldisclosure/2019/Apr/38","http://www.openwall.com/lists/oss-security/2019/04/30/4","http://www.securityfocus.com/bid/104450","http://www.securitytracker.com/id/1041051","https://access.redhat.com/errata/RHSA-2018:2180","https://access.redhat.com/errata/RHSA-2018:2181","https://dev.gnupg.org/T4012","https://github.com/RUB-NDS/Johnny-You-Are-Fired","https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html","https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html","https://usn.ubuntu.com/3675-1/","https://usn.ubuntu.com/3675-2/","https://usn.ubuntu.com/3675-3/","https://usn.ubuntu.com/3964-1/","https://www.debian.org/security/2018/dsa-4222","https://www.debian.org/security/2018/dsa-4223","https://www.debian.org/security/2018/dsa-4224"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes."}]},{"artifact":{"id":"f63526c0f98f2f89","cpes":["cpe:2.3:a:gpgv:gpgv:1.4.16-1ubuntu2.3:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/ubuntu/gpgv@1.4.16-1ubuntu2.3?arch=amd64&distro=ubuntu-14.04&upstream=gnupg","type":"deb","version":"1.4.16-1ubuntu2.3","language":"","licenses":["GPL-3","GPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.16-1ubuntu2.5"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12020","versionConstraint":"< 1.4.16-1ubuntu2.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnupg","version":"1.4.16-1ubuntu2.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12020","fix":{"state":"fixed","versions":["1.4.16-1ubuntu2.5"],"available":[{"date":"2018-06-11","kind":"advisory","version":"1.4.16-1ubuntu2.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-10-07","epss":0.08546,"percentile":0.94931}],"risk":4.273,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12020"},"relatedVulnerabilities":[{"id":"CVE-2018-12020","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12020","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12020","date":"2026-10-07","epss":0.08546,"percentile":0.94931}],"urls":["http://openwall.com/lists/oss-security/2018/06/08/2","http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html","http://seclists.org/fulldisclosure/2019/Apr/38","http://www.openwall.com/lists/oss-security/2019/04/30/4","http://www.securityfocus.com/bid/104450","http://www.securitytracker.com/id/1041051","https://access.redhat.com/errata/RHSA-2018:2180","https://access.redhat.com/errata/RHSA-2018:2181","https://dev.gnupg.org/T4012","https://github.com/RUB-NDS/Johnny-You-Are-Fired","https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf","https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0","https://lists.debian.org/debian-lts-announce/2021/12/msg00027.html","https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000425.html","https://usn.ubuntu.com/3675-1/","https://usn.ubuntu.com/3675-2/","https://usn.ubuntu.com/3675-3/","https://usn.ubuntu.com/3964-1/","https://www.debian.org/security/2018/dsa-4222","https://www.debian.org/security/2018/dsa-4223","https://www.debian.org/security/2018/dsa-4224"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12020","description":"mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the \"--status-fd 2\" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-1000254","versionConstraint":"< 7.35.0-1ubuntu2.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000254","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.11"],"available":[{"date":"2017-10-10","kind":"advisory","version":"7.35.0-1ubuntu2.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-07","epss":0.08465,"percentile":0.94885}],"risk":4.2325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000254"},"relatedVulnerabilities":[{"id":"CVE-2017-1000254","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-07","epss":0.08465,"percentile":0.94885}],"urls":["http://www.debian.org/security/2017/dsa-3992","http://www.securityfocus.com/bid/101115","http://www.securitytracker.com/id/1039509","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/673d0cd8.patch","https://curl.haxx.se/docs/adv_20171004.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201712-04","https://support.apple.com/HT208331"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000254","description":"libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000254","versionConstraint":"< 7.35.0-1ubuntu2.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000254","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.11"],"available":[{"date":"2017-10-10","kind":"advisory","version":"7.35.0-1ubuntu2.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-07","epss":0.08465,"percentile":0.94885}],"risk":4.2325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000254"},"relatedVulnerabilities":[{"id":"CVE-2017-1000254","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-07","epss":0.08465,"percentile":0.94885}],"urls":["http://www.debian.org/security/2017/dsa-3992","http://www.securityfocus.com/bid/101115","http://www.securitytracker.com/id/1039509","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/673d0cd8.patch","https://curl.haxx.se/docs/adv_20171004.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201712-04","https://support.apple.com/HT208331"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000254","description":"libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000254","versionConstraint":"< 7.35.0-1ubuntu2.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000254","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.11"],"available":[{"date":"2017-10-10","kind":"advisory","version":"7.35.0-1ubuntu2.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-07","epss":0.08465,"percentile":0.94885}],"risk":4.2325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000254"},"relatedVulnerabilities":[{"id":"CVE-2017-1000254","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000254","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000254","date":"2026-10-07","epss":0.08465,"percentile":0.94885}],"urls":["http://www.debian.org/security/2017/dsa-3992","http://www.securityfocus.com/bid/101115","http://www.securitytracker.com/id/1039509","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/673d0cd8.patch","https://curl.haxx.se/docs/adv_20171004.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://security.gentoo.org/glsa/201712-04","https://support.apple.com/HT208331"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000254","description":"libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-07","epss":0.08325,"percentile":0.94812}],"risk":4.1625000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0391"},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-07","epss":0.08325,"percentile":0.94812}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-07","epss":0.08325,"percentile":0.94812}],"risk":4.1625000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0391"},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-07","epss":0.08325,"percentile":0.94812}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-07","epss":0.08325,"percentile":0.94812}],"risk":4.1625000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0391"},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-07","epss":0.08325,"percentile":0.94812}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-0391","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-0391","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-07","epss":0.08325,"percentile":0.94812}],"risk":4.1625000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-0391"},"relatedVulnerabilities":[{"id":"CVE-2022-0391","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2022-0391","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-0391","date":"2026-10-07","epss":0.08325,"percentile":0.94812}],"urls":["https://bugs.python.org/issue43882","https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/","https://security.gentoo.org/glsa/202305-02","https://security.netapp.com/advisory/ntap-20220225-0009/","https://www.oracle.com/security-alerts/cpuapr2022.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-0391","description":"A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"risk":4.0745000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2389"},"relatedVulnerabilities":[{"id":"CVE-2021-2389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/","https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-880/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2389","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"risk":4.0745000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2389"},"relatedVulnerabilities":[{"id":"CVE-2021-2389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/","https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-880/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2389","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"risk":4.0745000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2389"},"relatedVulnerabilities":[{"id":"CVE-2021-2389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/","https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-880/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2389","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"risk":4.0745000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2389"},"relatedVulnerabilities":[{"id":"CVE-2021-2389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/","https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-880/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2389","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"risk":4.0745000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2389"},"relatedVulnerabilities":[{"id":"CVE-2021-2389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/","https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-880/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2389","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"risk":4.0745000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2389"},"relatedVulnerabilities":[{"id":"CVE-2021-2389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/","https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-880/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2389","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"risk":4.0745000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2389"},"relatedVulnerabilities":[{"id":"CVE-2021-2389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2389","date":"2026-10-07","epss":0.08149,"percentile":0.94712}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UTW5KMPPDKIMGB4ULE2HS22HYLVKYIH/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VGR5ZTB5QEDRRC6G5U6TFNCIVBBKGS5J/","https://security.netapp.com/advisory/ntap-20210723-0001/","https://www.oracle.com/security-alerts/cpujul2021.html","https://www.zerodayinitiative.com/advisories/ZDI-21-880/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2389","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.34 and prior and 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-5421","versionConstraint":"< 7.35.0-1ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5421","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.8"],"available":[{"date":"2016-08-08","kind":"advisory","version":"7.35.0-1ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5421","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5421","date":"2026-10-07","epss":0.08037,"percentile":0.94646}],"risk":4.0184999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5421"},"relatedVulnerabilities":[{"id":"CVE-2016-5421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5421","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5421","date":"2026-10-07","epss":0.08037,"percentile":0.94646}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92306","http://www.securitytracker.com/id/1036536","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803C.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5421","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5421","versionConstraint":"< 7.35.0-1ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5421","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.8"],"available":[{"date":"2016-08-08","kind":"advisory","version":"7.35.0-1ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5421","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5421","date":"2026-10-07","epss":0.08037,"percentile":0.94646}],"risk":4.0184999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5421"},"relatedVulnerabilities":[{"id":"CVE-2016-5421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5421","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5421","date":"2026-10-07","epss":0.08037,"percentile":0.94646}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92306","http://www.securitytracker.com/id/1036536","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803C.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5421","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-5421","versionConstraint":"< 7.35.0-1ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-5421","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.8"],"available":[{"date":"2016-08-08","kind":"advisory","version":"7.35.0-1ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-5421","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5421","date":"2026-10-07","epss":0.08037,"percentile":0.94646}],"risk":4.0184999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-5421"},"relatedVulnerabilities":[{"id":"CVE-2016-5421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-5421","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-5421","date":"2026-10-07","epss":0.08037,"percentile":0.94646}],"urls":["http://lists.opensuse.org/opensuse-updates/2016-09/msg00011.html","http://lists.opensuse.org/opensuse-updates/2016-09/msg00094.html","http://www.debian.org/security/2016/dsa-3638","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92306","http://www.securitytracker.com/id/1036536","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.563059","http://www.ubuntu.com/usn/USN-3048-1","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160803C.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLPXQQKURBQFM4XM6645VRPTOE2AWG33/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3GQH4V3XAQ5Z53AMQRDEC3C3UHTW7QR/","https://security.gentoo.org/glsa/201701-47","https://source.android.com/security/bulletin/2016-12-01.html","https://www.tenable.com/security/tns-2016-18"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-5421","description":"Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors."}]},{"artifact":{"id":"d654d35a4e09f2c2","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/ubuntu/libsasl2-2@2.1.25.dfsg1-17build1?arch=amd64&distro=ubuntu-14.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.25.dfsg1-17build1","language":"","licenses":["sha256:8787c01bde77ae4cf4bc657eb3e19d57f285e7d57d71feec20ac3e3dd45610f8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"cyrus-sasl2","version":"2.1.25.dfsg1-17build1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-07","epss":0.08036,"percentile":0.94645}],"risk":4.018,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-19906"},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-07","epss":0.08036,"percentile":0.94645}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"8b7bb767e1732fb3","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/ubuntu/libsasl2-modules-db@2.1.25.dfsg1-17build1?arch=amd64&distro=ubuntu-14.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.25.dfsg1-17build1","language":"","licenses":["sha256:8787c01bde77ae4cf4bc657eb3e19d57f285e7d57d71feec20ac3e3dd45610f8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19906","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"cyrus-sasl2","version":"2.1.25.dfsg1-17build1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-19906","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-07","epss":0.08036,"percentile":0.94645}],"risk":4.018,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-19906"},"relatedVulnerabilities":[{"id":"CVE-2019-19906","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19906","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-19906","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19906","date":"2026-10-07","epss":0.08036,"percentile":0.94645}],"urls":["http://seclists.org/fulldisclosure/2020/Jul/23","http://seclists.org/fulldisclosure/2020/Jul/24","http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/issues/587","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/12/msg00027.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MW6GZCLECGL2PBNHVNPJIX4RPVRVFR7R/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OB4GSVOJ6ESHQNT5GSV63OX5D4KPSTGT/","https://seclists.org/bugtraq/2019/Dec/42","https://support.apple.com/kb/HT211288","https://support.apple.com/kb/HT211289","https://usn.ubuntu.com/4256-1/","https://www.debian.org/security/2019/dsa-4591","https://www.openldap.org/its/index.cgi/Incoming?id=9123"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19906","description":"cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.14"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000007","versionConstraint":"< 7.35.0-1ubuntu2.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000007","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.14"],"available":[{"date":"2018-01-31","kind":"advisory","version":"7.35.0-1ubuntu2.14"}]},"cvss":[],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-07","epss":0.08031,"percentile":0.94642}],"risk":4.0155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000007"},"relatedVulnerabilities":[{"id":"CVE-2018-1000007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-07","epss":0.08031,"percentile":0.94642}],"urls":["http://www.openwall.com/lists/oss-security/2022/04/27/4","http://www.securitytracker.com/id/1040274","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b3bf.html","https://lists.debian.org/debian-lts-announce/2018/01/msg00038.html","https://usn.ubuntu.com/3554-1/","https://usn.ubuntu.com/3554-2/","https://www.debian.org/security/2018/dsa-4098","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000007","versionConstraint":"< 7.35.0-1ubuntu2.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000007","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.14"],"available":[{"date":"2018-01-31","kind":"advisory","version":"7.35.0-1ubuntu2.14"}]},"cvss":[],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-07","epss":0.08031,"percentile":0.94642}],"risk":4.0155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000007"},"relatedVulnerabilities":[{"id":"CVE-2018-1000007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-07","epss":0.08031,"percentile":0.94642}],"urls":["http://www.openwall.com/lists/oss-security/2022/04/27/4","http://www.securitytracker.com/id/1040274","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b3bf.html","https://lists.debian.org/debian-lts-announce/2018/01/msg00038.html","https://usn.ubuntu.com/3554-1/","https://usn.ubuntu.com/3554-2/","https://www.debian.org/security/2018/dsa-4098","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.14"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000007","versionConstraint":"< 7.35.0-1ubuntu2.14 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000007","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.14"],"available":[{"date":"2018-01-31","kind":"advisory","version":"7.35.0-1ubuntu2.14"}]},"cvss":[],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-07","epss":0.08031,"percentile":0.94642}],"risk":4.0155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000007"},"relatedVulnerabilities":[{"id":"CVE-2018-1000007","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-1000007","date":"2026-10-07","epss":0.08031,"percentile":0.94642}],"urls":["http://www.openwall.com/lists/oss-security/2022/04/27/4","http://www.securitytracker.com/id/1040274","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2019:1543","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b3bf.html","https://lists.debian.org/debian-lts-announce/2018/01/msg00038.html","https://usn.ubuntu.com/3554-1/","https://usn.ubuntu.com/3554-2/","https://www.debian.org/security/2018/dsa-4098","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000007","description":"libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request."}]},{"artifact":{"id":"446829d742a92a16","cpes":["cpe:2.3:a:libgnutls-openssl27:libgnutls-openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-openssl27:libgnutls_openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_openssl27:libgnutls-openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_openssl27:libgnutls_openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*"],"name":"libgnutls-openssl27","purl":"pkg:deb/ubuntu/libgnutls-openssl27@2.12.23-12ubuntu2.5?arch=amd64&distro=ubuntu-14.04&upstream=gnutls26","type":"deb","version":"2.12.23-12ubuntu2.5","language":"","licenses":["sha256:12ca70c4bdcdff66bcbc6405d521f461b0cbb7bccf6d426e3ca6ef63ff132343"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-openssl27/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libgnutls-openssl27/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-openssl27:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libgnutls-openssl27:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls26"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.12.23-12ubuntu2.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5335","versionConstraint":"< 2.12.23-12ubuntu2.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnutls26","version":"2.12.23-12ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-5335","fix":{"state":"fixed","versions":["2.12.23-12ubuntu2.6"],"available":[{"date":"2017-02-01","kind":"advisory","version":"2.12.23-12ubuntu2.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5335","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5335","date":"2026-10-07","epss":0.08009,"percentile":0.94628}],"risk":4.0045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-5335"},"relatedVulnerabilities":[{"id":"CVE-2017-5335","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5335","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5335","date":"2026-10-07","epss":0.08009,"percentile":0.94628}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://www.openwall.com/lists/oss-security/2017/01/10/7","http://www.openwall.com/lists/oss-security/2017/01/11/4","http://www.securityfocus.com/bid/95374","http://www.securitytracker.com/id/1037576","https://access.redhat.com/errata/RHSA-2017:2292","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=337","https://gitlab.com/gnutls/gnutls/commit/49be4f7b82eba2363bb8d4090950dad976a77a3a","https://gnutls.org/security.html#GNUTLS-SA-2017-2","https://security.gentoo.org/glsa/201702-04"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5335","description":"The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate."}]},{"artifact":{"id":"45c8da2f19469884","cpes":["cpe:2.3:a:libgnutls26:libgnutls26:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*"],"name":"libgnutls26","purl":"pkg:deb/ubuntu/libgnutls26@2.12.23-12ubuntu2.5?arch=amd64&distro=ubuntu-14.04&upstream=gnutls26","type":"deb","version":"2.12.23-12ubuntu2.5","language":"","licenses":["sha256:12ca70c4bdcdff66bcbc6405d521f461b0cbb7bccf6d426e3ca6ef63ff132343"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls26/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libgnutls26/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls26:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libgnutls26:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls26"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.12.23-12ubuntu2.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5335","versionConstraint":"< 2.12.23-12ubuntu2.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnutls26","version":"2.12.23-12ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-5335","fix":{"state":"fixed","versions":["2.12.23-12ubuntu2.6"],"available":[{"date":"2017-02-01","kind":"advisory","version":"2.12.23-12ubuntu2.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5335","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5335","date":"2026-10-07","epss":0.08009,"percentile":0.94628}],"risk":4.0045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-5335"},"relatedVulnerabilities":[{"id":"CVE-2017-5335","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5335","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5335","date":"2026-10-07","epss":0.08009,"percentile":0.94628}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://www.openwall.com/lists/oss-security/2017/01/10/7","http://www.openwall.com/lists/oss-security/2017/01/11/4","http://www.securityfocus.com/bid/95374","http://www.securitytracker.com/id/1037576","https://access.redhat.com/errata/RHSA-2017:2292","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=337","https://gitlab.com/gnutls/gnutls/commit/49be4f7b82eba2363bb8d4090950dad976a77a3a","https://gnutls.org/security.html#GNUTLS-SA-2017-2","https://security.gentoo.org/glsa/201702-04"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5335","description":"The stream reading functions in lib/opencdk/read-packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate."}]},{"artifact":{"id":"91e22e3289c39d88","cpes":["cpe:2.3:a:bzip2:bzip2:1.0.6-5:*:*:*:*:*:*:*"],"name":"bzip2","purl":"pkg:deb/ubuntu/bzip2@1.0.6-5?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.6-5","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bzip2/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/bzip2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bzip2.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/bzip2.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bzip2.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/bzip2.list"},{"path":"/var/lib/dpkg/info/bzip2.preinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/bzip2.preinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-12900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"bzip2","version":"1.0.6-5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-12900","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-10-07","epss":0.07977,"percentile":0.94611}],"risk":3.9884999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-12900"},"relatedVulnerabilities":[{"id":"CVE-2019-12900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-10-07","epss":0.07977,"percentile":0.94611}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html","http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html","http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://support.f5.com/csp/article/K68713584?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://usn.ubuntu.com/4146-1/","https://usn.ubuntu.com/4146-2/","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12900","description":"BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors."}]},{"artifact":{"id":"f59d1e0c17b85413","cpes":["cpe:2.3:a:libbz2-1.0:libbz2-1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2-1.0:libbz2_1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2-1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2_1.0:libbz2_1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2-1.0:1.0.6-5:*:*:*:*:*:*:*","cpe:2.3:a:libbz2:libbz2_1.0:1.0.6-5:*:*:*:*:*:*:*"],"name":"libbz2-1.0","purl":"pkg:deb/ubuntu/libbz2-1.0@1.0.6-5?arch=amd64&distro=ubuntu-14.04&upstream=bzip2","type":"deb","version":"1.0.6-5","language":"","licenses":["bzip2-1.0.6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libbz2-1.0/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/libbz2-1.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/libbz2-1.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"bzip2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-12900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"bzip2","version":"1.0.6-5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-12900","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-10-07","epss":0.07977,"percentile":0.94611}],"risk":3.9884999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-12900"},"relatedVulnerabilities":[{"id":"CVE-2019-12900","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-12900","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-12900","date":"2026-10-07","epss":0.07977,"percentile":0.94611}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html","http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html","http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html","http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html","https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc","https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html","https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html","https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html","https://seclists.org/bugtraq/2019/Aug/4","https://seclists.org/bugtraq/2019/Jul/22","https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc","https://support.f5.com/csp/article/K68713584?utm_source=f5support&amp%3Butm_medium=RSS","https://usn.ubuntu.com/4038-1/","https://usn.ubuntu.com/4038-2/","https://usn.ubuntu.com/4146-1/","https://usn.ubuntu.com/4146-2/","https://www.oracle.com/security-alerts/cpuoct2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-12900","description":"BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 3.4.3-1ubuntu1~14.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.6"],"available":[{"date":"2017-11-28","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-10-07","epss":0.07944,"percentile":0.94595}],"risk":3.972,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000158"},"relatedVulnerabilities":[{"id":"CVE-2017-1000158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-10-07","epss":0.07944,"percentile":0.94595}],"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 3.4.3-1ubuntu1~14.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.6"],"available":[{"date":"2017-11-28","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-10-07","epss":0.07944,"percentile":0.94595}],"risk":3.972,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000158"},"relatedVulnerabilities":[{"id":"CVE-2017-1000158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-10-07","epss":0.07944,"percentile":0.94595}],"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 3.4.3-1ubuntu1~14.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.6"],"available":[{"date":"2017-11-28","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-10-07","epss":0.07944,"percentile":0.94595}],"risk":3.972,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000158"},"relatedVulnerabilities":[{"id":"CVE-2017-1000158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-10-07","epss":0.07944,"percentile":0.94595}],"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.4.3-1ubuntu1~14.04.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000158","versionConstraint":"< 3.4.3-1ubuntu1~14.04.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000158","fix":{"state":"fixed","versions":["3.4.3-1ubuntu1~14.04.6"],"available":[{"date":"2017-11-28","kind":"advisory","version":"3.4.3-1ubuntu1~14.04.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-10-07","epss":0.07944,"percentile":0.94595}],"risk":3.972,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000158"},"relatedVulnerabilities":[{"id":"CVE-2017-1000158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000158","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-1000158","date":"2026-10-07","epss":0.07944,"percentile":0.94595}],"urls":["http://www.securitytracker.com/id/1039890","https://bugs.python.org/issue30657","https://lists.debian.org/debian-lts-announce/2017/11/msg00035.html","https://lists.debian.org/debian-lts-announce/2017/11/msg00036.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00030.html","https://lists.debian.org/debian-lts-announce/2018/09/msg00031.html","https://security.gentoo.org/glsa/201805-02","https://security.netapp.com/advisory/ntap-20230216-0001/","https://www.debian.org/security/2018/dsa-4307"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000158","description":"CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting in heap-based buffer overflow (and possible arbitrary code execution)"}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-4954","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-4954","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"],"available":[{"date":"2016-10-05","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-4954","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4954","date":"2026-10-07","epss":0.13208,"percentile":0.96282}],"risk":3.9624,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-4954"},"relatedVulnerabilities":[{"id":"CVE-2016-4954","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-4954","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-4954","date":"2026-10-07","epss":0.13208,"percentile":0.96282}],"urls":["http://bugs.ntp.org/3044","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html","http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html","http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html","http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html","http://packetstormsecurity.com/files/137321/Slackware-Security-Advisory-ntp-Updates.html","http://packetstormsecurity.com/files/137322/FreeBSD-Security-Advisory-FreeBSD-SA-16-24.ntp.html","http://support.ntp.org/bin/view/Main/NtpBug3044","http://support.ntp.org/bin/view/Main/SecurityNotice","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160603-ntpd","http://www.kb.cert.org/vuls/id/321640","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.securityfocus.com/archive/1/538599/100/0/threaded","http://www.securityfocus.com/archive/1/538600/100/0/threaded","http://www.securityfocus.com/archive/1/540683/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/538599/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/538600/100/0/threaded","http://www.securityfocus.com/archive/1/archive/1/540683/100/0/threaded","http://www.securitytracker.com/id/1036037","http://www.ubuntu.com/usn/USN-3096-1","https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03757en_us","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3EYJQHJZ2KTVQ7ICEFHXTLZ36MRASWX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORAMN3Q7TVJ54MBYF75XCJOE3DP7LYHT/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNWGCQLW2VY72NIUYMJOCAKJKTXHDUK2/","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:24.ntp.asc","https://security.gentoo.org/glsa/201607-15","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11","https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11","https://www.kb.cert.org/vuls/id/321640"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4954","description":"The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication."}]},{"artifact":{"id":"3695a31b2933dc8f","cpes":["cpe:2.3:a:openssh-client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_client:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_client:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-client","purl":"pkg:deb/ubuntu/openssh-client@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.list"},{"path":"/var/lib/dpkg/info/openssh-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postinst"},{"path":"/var/lib/dpkg/info/openssh-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.postrm"},{"path":"/var/lib/dpkg/info/openssh-client.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-client.prerm"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-15778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-15778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-15778","date":"2026-10-07","epss":0.12996,"percentile":0.96236}],"risk":3.8987999999999996,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-15778"},"relatedVulnerabilities":[{"id":"CVE-2020-15778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-15778","date":"2026-10-07","epss":0.12996,"percentile":0.96236}],"urls":["https://access.redhat.com/errata/RHSA-2024:3166","https://github.com/cpandya2909/CVE-2020-15778/","https://news.ycombinator.com/item?id=25005567","https://security.gentoo.org/glsa/202212-06","https://security.netapp.com/advisory/ntap-20200731-0007/","https://www.openssh.com/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15778","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\""}]},{"artifact":{"id":"54d7c6e40533c708","cpes":["cpe:2.3:a:openssh-server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_server:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-server","purl":"pkg:deb/ubuntu/openssh-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-server.config","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.config"},{"path":"/var/lib/dpkg/info/openssh-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.list"},{"path":"/var/lib/dpkg/info/openssh-server.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postinst"},{"path":"/var/lib/dpkg/info/openssh-server.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.postrm"},{"path":"/var/lib/dpkg/info/openssh-server.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.preinst"},{"path":"/var/lib/dpkg/info/openssh-server.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.prerm"},{"path":"/var/lib/dpkg/info/openssh-server.templates","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-server.templates"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-15778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-15778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-15778","date":"2026-10-07","epss":0.12996,"percentile":0.96236}],"risk":3.8987999999999996,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-15778"},"relatedVulnerabilities":[{"id":"CVE-2020-15778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-15778","date":"2026-10-07","epss":0.12996,"percentile":0.96236}],"urls":["https://access.redhat.com/errata/RHSA-2024:3166","https://github.com/cpandya2909/CVE-2020-15778/","https://news.ycombinator.com/item?id=25005567","https://security.gentoo.org/glsa/202212-06","https://security.netapp.com/advisory/ntap-20200731-0007/","https://www.openssh.com/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15778","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\""}]},{"artifact":{"id":"b3db4be88de03e2f","cpes":["cpe:2.3:a:openssh-sftp-server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp-server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp_server:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh-sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh_sftp:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh-sftp-server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:openssh:openssh_sftp_server:1\\:6.6p1-2ubuntu2.7:*:*:*:*:*:*:*"],"name":"openssh-sftp-server","purl":"pkg:deb/ubuntu/openssh-sftp-server@1%3A6.6p1-2ubuntu2.7?arch=amd64&distro=ubuntu-14.04&upstream=openssh","type":"deb","version":"1:6.6p1-2ubuntu2.7","language":"","licenses":["sha256:48f6bbfc2412b58d23bd8c74649b6b92e809ec321544b79af45440bee1a55918"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/openssh-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssh-sftp-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssh-sftp-server.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssh-sftp-server.list"}],"upstreams":[{"name":"openssh"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-15778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssh","version":"1:6.6p1-2ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-15778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-15778","date":"2026-10-07","epss":0.12996,"percentile":0.96236}],"risk":3.8987999999999996,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-15778"},"relatedVulnerabilities":[{"id":"CVE-2020-15778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.9,"exploitabilityScore":1.6},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-15778","cwe":"CWE-78","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2020-15778","date":"2026-10-07","epss":0.12996,"percentile":0.96236}],"urls":["https://access.redhat.com/errata/RHSA-2024:3166","https://github.com/cpandya2909/CVE-2020-15778/","https://news.ycombinator.com/item?id=25005567","https://security.gentoo.org/glsa/202212-06","https://security.netapp.com/advisory/ntap-20200731-0007/","https://www.openssh.com/security.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15778","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\""}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-14422","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-14422","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-10-07","epss":0.12706,"percentile":0.9617}],"risk":3.8118,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-14422"},"relatedVulnerabilities":[{"id":"CVE-2020-14422","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-10-07","epss":0.12706,"percentile":0.9617}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html","https://bugs.python.org/issue41004","https://github.com/python/cpython/pull/20956","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200724-0004/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14422","description":"Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-14422","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-14422","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-10-07","epss":0.12706,"percentile":0.9617}],"risk":3.8118,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-14422"},"relatedVulnerabilities":[{"id":"CVE-2020-14422","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-10-07","epss":0.12706,"percentile":0.9617}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html","https://bugs.python.org/issue41004","https://github.com/python/cpython/pull/20956","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200724-0004/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14422","description":"Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-14422","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-14422","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-10-07","epss":0.12706,"percentile":0.9617}],"risk":3.8118,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-14422"},"relatedVulnerabilities":[{"id":"CVE-2020-14422","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-10-07","epss":0.12706,"percentile":0.9617}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html","https://bugs.python.org/issue41004","https://github.com/python/cpython/pull/20956","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200724-0004/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14422","description":"Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-14422","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-14422","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-10-07","epss":0.12706,"percentile":0.9617}],"risk":3.8118,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-14422"},"relatedVulnerabilities":[{"id":"CVE-2020-14422","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-14422","cwe":"CWE-330","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-14422","cwe":"CWE-682","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-14422","date":"2026-10-07","epss":0.12706,"percentile":0.9617}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00006.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00032.html","http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00041.html","https://bugs.python.org/issue41004","https://github.com/python/cpython/pull/20956","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00016.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FCCZTAYZATTNSNEAXWA7U3HCO2OVQKT5/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X36Y523UAZY5QFXZAAORNFY63HLBWX7N/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200724-0004/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-14422","description":"Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2."}]},{"artifact":{"id":"9f127744e4033e99","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.8.2-1ubuntu2.1?arch=amd64&distro=ubuntu-14.04&upstream=sqlite3","type":"deb","version":"3.8.2-1ubuntu2.1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20506","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sqlite3","version":"3.8.2-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-20506","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20506","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20506","date":"2026-10-07","epss":0.07565,"percentile":0.94373}],"risk":3.7824999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20506"},"relatedVulnerabilities":[{"id":"CVE-2018-20506","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20506","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20506","date":"2026-10-07","epss":0.07565,"percentile":0.94373}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00070.html","http://seclists.org/fulldisclosure/2019/Jan/62","http://seclists.org/fulldisclosure/2019/Jan/64","http://seclists.org/fulldisclosure/2019/Jan/66","http://seclists.org/fulldisclosure/2019/Jan/67","http://seclists.org/fulldisclosure/2019/Jan/68","http://seclists.org/fulldisclosure/2019/Jan/69","http://www.securityfocus.com/bid/106698","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html","https://seclists.org/bugtraq/2019/Jan/28","https://seclists.org/bugtraq/2019/Jan/29","https://seclists.org/bugtraq/2019/Jan/31","https://seclists.org/bugtraq/2019/Jan/32","https://seclists.org/bugtraq/2019/Jan/33","https://seclists.org/bugtraq/2019/Jan/39","https://security.netapp.com/advisory/ntap-20190502-0004/","https://sqlite.org/src/info/940f2adc8541a838","https://support.apple.com/kb/HT209443","https://support.apple.com/kb/HT209446","https://support.apple.com/kb/HT209447","https://support.apple.com/kb/HT209448","https://support.apple.com/kb/HT209450","https://support.apple.com/kb/HT209451","https://usn.ubuntu.com/4019-1/","https://usn.ubuntu.com/4019-2/","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20506","description":"SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a \"merge\" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-32208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-32208","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-10-07","epss":0.07499,"percentile":0.94333}],"risk":3.7495000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-32208"},"relatedVulnerabilities":[{"id":"CVE-2022-32208","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-10-07","epss":0.07499,"percentile":0.94333}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://hackerone.com/reports/1590071","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220915-0003/","https://support.apple.com/kb/HT213488","https://www.debian.org/security/2022/dsa-5197"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32208","description":"When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-32208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-32208","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-10-07","epss":0.07499,"percentile":0.94333}],"risk":3.7495000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-32208"},"relatedVulnerabilities":[{"id":"CVE-2022-32208","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-10-07","epss":0.07499,"percentile":0.94333}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://hackerone.com/reports/1590071","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220915-0003/","https://support.apple.com/kb/HT213488","https://www.debian.org/security/2022/dsa-5197"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32208","description":"When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-32208","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-32208","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-10-07","epss":0.07499,"percentile":0.94333}],"risk":3.7495000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-32208"},"relatedVulnerabilities":[{"id":"CVE-2022-32208","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-32208","cwe":"CWE-840","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2022-32208","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-32208","date":"2026-10-07","epss":0.07499,"percentile":0.94333}],"urls":["http://seclists.org/fulldisclosure/2022/Oct/28","http://seclists.org/fulldisclosure/2022/Oct/41","https://hackerone.com/reports/1590071","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEV6BR4MTI3CEWK2YU2HQZUW5FAS3FEY/","https://security.gentoo.org/glsa/202212-01","https://security.netapp.com/advisory/ntap-20220915-0003/","https://support.apple.com/kb/HT213488","https://www.debian.org/security/2022/dsa-5197"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-32208","description":"When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2471","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"risk":3.7464999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2471"},"relatedVulnerabilities":[{"id":"CVE-2021-2471","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:C/I:N/A:C","metrics":{"baseScore":7.9,"impactScore":9.3,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"urls":["https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2471","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H)."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2471","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"risk":3.7464999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2471"},"relatedVulnerabilities":[{"id":"CVE-2021-2471","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:C/I:N/A:C","metrics":{"baseScore":7.9,"impactScore":9.3,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"urls":["https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2471","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H)."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2471","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"risk":3.7464999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2471"},"relatedVulnerabilities":[{"id":"CVE-2021-2471","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:C/I:N/A:C","metrics":{"baseScore":7.9,"impactScore":9.3,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"urls":["https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2471","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H)."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2471","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"risk":3.7464999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2471"},"relatedVulnerabilities":[{"id":"CVE-2021-2471","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:C/I:N/A:C","metrics":{"baseScore":7.9,"impactScore":9.3,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"urls":["https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2471","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H)."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2471","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"risk":3.7464999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2471"},"relatedVulnerabilities":[{"id":"CVE-2021-2471","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:C/I:N/A:C","metrics":{"baseScore":7.9,"impactScore":9.3,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"urls":["https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2471","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H)."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2471","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"risk":3.7464999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2471"},"relatedVulnerabilities":[{"id":"CVE-2021-2471","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:C/I:N/A:C","metrics":{"baseScore":7.9,"impactScore":9.3,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"urls":["https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2471","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H)."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-2471","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-2471","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"risk":3.7464999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-2471"},"relatedVulnerabilities":[{"id":"CVE-2021-2471","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:S/C:C/I:N/A:C","metrics":{"baseScore":7.9,"impactScore":9.3,"exploitabilityScore":6.9},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":5.2,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-2471","date":"2026-10-07","epss":0.07493,"percentile":0.9433}],"urls":["https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-2471","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H)."}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7426","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-7426","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.11"],"available":[{"date":"2017-07-05","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7426","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7426","date":"2026-10-07","epss":0.12466,"percentile":0.9612}],"risk":3.7398000000000002,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-7426"},"relatedVulnerabilities":[{"id":"CVE-2016-7426","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7426","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7426","date":"2026-10-07","epss":0.12466,"percentile":0.9612}],"urls":["http://nwtime.org/ntp428p9_release/","http://rhn.redhat.com/errata/RHSA-2017-0252.html","http://support.ntp.org/bin/view/Main/NtpBug3071","http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities","http://www.securityfocus.com/bid/94451","http://www.securitytracker.com/id/1037354","https://bto.bluecoat.com/security-advisory/sa139","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03706en_us","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:39.ntp.asc","https://usn.ubuntu.com/3707-2/","https://www.kb.cert.org/vuls/id/633847"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7426","description":"NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address."}]},{"artifact":{"id":"13f1f625364f1dc7","cpes":["cpe:2.3:a:libsystemd-daemon0:libsystemd-daemon0:204-5ubuntu20.19:*:*:*:*:*:*:*","cpe:2.3:a:libsystemd-daemon0:libsystemd_daemon0:204-5ubuntu20.19:*:*:*:*:*:*:*","cpe:2.3:a:libsystemd_daemon0:libsystemd-daemon0:204-5ubuntu20.19:*:*:*:*:*:*:*","cpe:2.3:a:libsystemd_daemon0:libsystemd_daemon0:204-5ubuntu20.19:*:*:*:*:*:*:*","cpe:2.3:a:libsystemd:libsystemd-daemon0:204-5ubuntu20.19:*:*:*:*:*:*:*","cpe:2.3:a:libsystemd:libsystemd_daemon0:204-5ubuntu20.19:*:*:*:*:*:*:*"],"name":"libsystemd-daemon0","purl":"pkg:deb/ubuntu/libsystemd-daemon0@204-5ubuntu20.19?arch=amd64&distro=ubuntu-14.04&upstream=systemd","type":"deb","version":"204-5ubuntu20.19","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd-daemon0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libsystemd-daemon0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd-daemon0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libsystemd-daemon0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"204-5ubuntu20.26"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 204-5ubuntu20.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"systemd","version":"204-5ubuntu20.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["204-5ubuntu20.26"],"available":[{"date":"2018-02-05","kind":"advisory","version":"204-5ubuntu20.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-07","epss":0.07441,"percentile":0.94301}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-07","epss":0.07441,"percentile":0.94301}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"adcf438c27b81650","cpes":["cpe:2.3:a:libudev1:libudev1:204-5ubuntu20.19:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@204-5ubuntu20.19?arch=amd64&distro=ubuntu-14.04&upstream=systemd","type":"deb","version":"204-5ubuntu20.19","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"204-5ubuntu20.26"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 204-5ubuntu20.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"systemd","version":"204-5ubuntu20.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["204-5ubuntu20.26"],"available":[{"date":"2018-02-05","kind":"advisory","version":"204-5ubuntu20.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-07","epss":0.07441,"percentile":0.94301}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-07","epss":0.07441,"percentile":0.94301}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"53abf986b9333a32","cpes":["cpe:2.3:a:udev:udev:204-5ubuntu20.19:*:*:*:*:*:*:*"],"name":"udev","purl":"pkg:deb/ubuntu/udev@204-5ubuntu20.19?arch=amd64&distro=ubuntu-14.04&upstream=systemd","type":"deb","version":"204-5ubuntu20.19","language":"","licenses":["Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/udev/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/udev/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/udev.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/udev.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/udev.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/udev.list"},{"path":"/var/lib/dpkg/info/udev.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/udev.postinst"},{"path":"/var/lib/dpkg/info/udev.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/udev.postrm"},{"path":"/var/lib/dpkg/info/udev.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/udev.preinst"},{"path":"/var/lib/dpkg/info/udev.triggers","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/udev.triggers"}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"fix":{"suggestedVersion":"204-5ubuntu20.26"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1049","versionConstraint":"< 204-5ubuntu20.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"systemd","version":"204-5ubuntu20.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1049","fix":{"state":"fixed","versions":["204-5ubuntu20.26"],"available":[{"date":"2018-02-05","kind":"advisory","version":"204-5ubuntu20.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-07","epss":0.07441,"percentile":0.94301}],"risk":3.7205000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1049"},"relatedVulnerabilities":[{"id":"CVE-2018-1049","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-1049","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-1049","date":"2026-10-07","epss":0.07441,"percentile":0.94301}],"urls":["http://www.securitytracker.com/id/1041520","https://access.redhat.com/errata/RHSA-2018:0260","https://bugzilla.redhat.com/show_bug.cgi?id=1534701","https://lists.debian.org/debian-lts-announce/2018/11/msg00017.html","https://usn.ubuntu.com/3558-1/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1049","description":"In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel holding the mountpoint and any processes that try to use said mount will hang. A race condition like this may lead to denial of service, until mount points are unmounted."}]},{"artifact":{"id":"df1837354f8ead15","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.1.0-4ubuntu1.3?arch=amd64&distro=ubuntu-14.04&upstream=expat","type":"deb","version":"2.1.0-4ubuntu1.3","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-25235","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"expat","version":"2.1.0-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-25235","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-25235","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25235","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25235","date":"2026-10-07","epss":0.04955,"percentile":0.91948}],"risk":3.71625,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-25235"},"relatedVulnerabilities":[{"id":"CVE-2022-25235","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-25235","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-25235","cwe":"CWE-116","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-25235","date":"2026-10-07","epss":0.04955,"percentile":0.91948}],"urls":["http://www.openwall.com/lists/oss-security/2022/02/19/1","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://github.com/libexpat/libexpat/pull/562","https://lists.debian.org/debian-lts-announce/2022/03/msg00007.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/","https://security.gentoo.org/glsa/202209-24","https://security.netapp.com/advisory/ntap-20220303-0008/","https://www.debian.org/security/2022/dsa-5085","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25235","description":"xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-23841","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23841","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23841","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23841","date":"2026-10-07","epss":0.0741,"percentile":0.94286}],"risk":3.705,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23841"},"relatedVulnerabilities":[{"id":"CVE-2021-23841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23841","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23841","date":"2026-10-07","epss":0.0741,"percentile":0.94286}],"urls":["http://seclists.org/fulldisclosure/2021/May/67","http://seclists.org/fulldisclosure/2021/May/68","http://seclists.org/fulldisclosure/2021/May/70","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=122a19ab48091c657f7cb1fb3af9fc07bd557bbf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8252ee4d90f3f2004d3d0aeeed003ad49c9a7807","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://support.apple.com/kb/HT212528","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212534","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23841","description":"The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-23841","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-23841","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-23841","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23841","date":"2026-10-07","epss":0.0741,"percentile":0.94286}],"risk":3.705,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-23841"},"relatedVulnerabilities":[{"id":"CVE-2021-23841","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-23841","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-23841","date":"2026-10-07","epss":0.0741,"percentile":0.94286}],"urls":["http://seclists.org/fulldisclosure/2021/May/67","http://seclists.org/fulldisclosure/2021/May/68","http://seclists.org/fulldisclosure/2021/May/70","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=122a19ab48091c657f7cb1fb3af9fc07bd557bbf","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8252ee4d90f3f2004d3d0aeeed003ad49c9a7807","https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44846","https://security.gentoo.org/glsa/202103-03","https://security.netapp.com/advisory/ntap-20210219-0009/","https://security.netapp.com/advisory/ntap-20210513-0002/","https://security.netapp.com/advisory/ntap-20240621-0006/","https://support.apple.com/kb/HT212528","https://support.apple.com/kb/HT212529","https://support.apple.com/kb/HT212534","https://www.debian.org/security/2021/dsa-4855","https://www.openssl.org/news/secadv/20210216.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.tenable.com/security/tns-2021-03","https://www.tenable.com/security/tns-2021-09"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23841","description":"The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x)."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2015-3153","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-3153","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-3153","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3153","date":"2026-10-07","epss":0.07337,"percentile":0.9424}],"risk":3.6685000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-3153"},"relatedVulnerabilities":[{"id":"CVE-2015-3153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-3153","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3153","date":"2026-10-07","epss":0.07337,"percentile":0.9424}],"urls":["http://curl.haxx.se/docs/adv_20150429.html","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743","http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html","http://www.debian.org/security/2015/dsa-3240","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","http://www.securityfocus.com/bid/74408","http://www.securitytracker.com/id/1032233","http://www.ubuntu.com/usn/USN-2591-1","https://kc.mcafee.com/corporate/index?page=content&id=SB10131","https://support.apple.com/kb/HT205031"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3153","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-3153","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-3153","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-3153","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3153","date":"2026-10-07","epss":0.07337,"percentile":0.9424}],"risk":3.6685000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-3153"},"relatedVulnerabilities":[{"id":"CVE-2015-3153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-3153","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3153","date":"2026-10-07","epss":0.07337,"percentile":0.9424}],"urls":["http://curl.haxx.se/docs/adv_20150429.html","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743","http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html","http://www.debian.org/security/2015/dsa-3240","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","http://www.securityfocus.com/bid/74408","http://www.securitytracker.com/id/1032233","http://www.ubuntu.com/usn/USN-2591-1","https://kc.mcafee.com/corporate/index?page=content&id=SB10131","https://support.apple.com/kb/HT205031"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3153","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-3153","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-3153","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-3153","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3153","date":"2026-10-07","epss":0.07337,"percentile":0.9424}],"risk":3.6685000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-3153"},"relatedVulnerabilities":[{"id":"CVE-2015-3153","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-3153","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-3153","date":"2026-10-07","epss":0.07337,"percentile":0.9424}],"urls":["http://curl.haxx.se/docs/adv_20150429.html","http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743","http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","http://lists.opensuse.org/opensuse-updates/2015-05/msg00017.html","http://www.debian.org/security/2015/dsa-3240","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html","http://www.securityfocus.com/bid/74408","http://www.securitytracker.com/id/1032233","http://www.ubuntu.com/usn/USN-2591-1","https://kc.mcafee.com/corporate/index?page=content&id=SB10131","https://support.apple.com/kb/HT205031"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-3153","description":"The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might allow remote proxy servers to obtain sensitive information by reading the header contents."}]},{"artifact":{"id":"71081c257357e0b6","cpes":["cpe:2.3:a:perl:perl:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-12015","versionConstraint":"< 5.18.2-2ubuntu1.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12015","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.6"],"available":[{"date":"2018-06-13","kind":"advisory","version":"5.18.2-2ubuntu1.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-07","epss":0.0731,"percentile":0.94224}],"risk":3.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12015"},"relatedVulnerabilities":[{"id":"CVE-2018-12015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-07","epss":0.0731,"percentile":0.94224}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/104423","http://www.securitytracker.com/id/1041048","https://access.redhat.com/errata/RHSA-2019:2097","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834","https://seclists.org/bugtraq/2019/Mar/42","https://security.netapp.com/advisory/ntap-20180927-0001/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3684-1/","https://usn.ubuntu.com/3684-2/","https://www.debian.org/security/2018/dsa-4226","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12015","description":"In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name."}]},{"artifact":{"id":"b6e547621bce8e70","cpes":["cpe:2.3:a:perl-base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12015","versionConstraint":"< 5.18.2-2ubuntu1.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12015","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.6"],"available":[{"date":"2018-06-13","kind":"advisory","version":"5.18.2-2ubuntu1.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-07","epss":0.0731,"percentile":0.94224}],"risk":3.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12015"},"relatedVulnerabilities":[{"id":"CVE-2018-12015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-07","epss":0.0731,"percentile":0.94224}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/104423","http://www.securitytracker.com/id/1041048","https://access.redhat.com/errata/RHSA-2019:2097","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834","https://seclists.org/bugtraq/2019/Mar/42","https://security.netapp.com/advisory/ntap-20180927-0001/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3684-1/","https://usn.ubuntu.com/3684-2/","https://www.debian.org/security/2018/dsa-4226","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12015","description":"In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name."}]},{"artifact":{"id":"9a3f82ec97b0252b","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/ubuntu/perl-modules@5.18.2-2ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-12015","versionConstraint":"< 5.18.2-2ubuntu1.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-12015","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.6"],"available":[{"date":"2018-06-13","kind":"advisory","version":"5.18.2-2ubuntu1.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-07","epss":0.0731,"percentile":0.94224}],"risk":3.655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-12015"},"relatedVulnerabilities":[{"id":"CVE-2018-12015","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-12015","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-12015","date":"2026-10-07","epss":0.0731,"percentile":0.94224}],"urls":["http://seclists.org/fulldisclosure/2019/Mar/49","http://www.securityfocus.com/bid/104423","http://www.securitytracker.com/id/1041048","https://access.redhat.com/errata/RHSA-2019:2097","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900834","https://seclists.org/bugtraq/2019/Mar/42","https://security.netapp.com/advisory/ntap-20180927-0001/","https://support.apple.com/kb/HT209600","https://usn.ubuntu.com/3684-1/","https://usn.ubuntu.com/3684-2/","https://www.debian.org/security/2018/dsa-4226","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-12015","description":"In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.27"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0734","versionConstraint":"< 1.0.1f-1ubuntu2.27 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0734","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.27"],"available":[{"date":"2018-12-06","kind":"advisory","version":"1.0.1f-1ubuntu2.27"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-07","epss":0.12154,"percentile":0.96059}],"risk":3.6461999999999994,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0734"},"relatedVulnerabilities":[{"id":"CVE-2018-0734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-07","epss":0.12154,"percentile":0.96059}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://www.securityfocus.com/bid/105758","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:3700","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20181030.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-16","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0734","description":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.27"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0734","versionConstraint":"< 1.0.1f-1ubuntu2.27 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0734","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.27"],"available":[{"date":"2018-12-06","kind":"advisory","version":"1.0.1f-1ubuntu2.27"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-07","epss":0.12154,"percentile":0.96059}],"risk":3.6461999999999994,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0734"},"relatedVulnerabilities":[{"id":"CVE-2018-0734","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0734","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0734","date":"2026-10-07","epss":0.12154,"percentile":0.96059}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html","http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html","http://www.securityfocus.com/bid/105758","https://access.redhat.com/errata/RHSA-2019:2304","https://access.redhat.com/errata/RHSA-2019:3700","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/","https://security.netapp.com/advisory/ntap-20181105-0002/","https://security.netapp.com/advisory/ntap-20190118-0002/","https://security.netapp.com/advisory/ntap-20190423-0002/","https://usn.ubuntu.com/3840-1/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20181030.txt","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujan2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-16","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0734","description":"The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p)."}]},{"artifact":{"id":"f93e78451600da86","cpes":["cpe:2.3:a:libldap-2.4-2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4-2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4_2:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap-2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap_2.4:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap-2.4-2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*","cpe:2.3:a:libldap:libldap_2.4_2:2.4.31-1\\+nmu2ubuntu8.2:*:*:*:*:*:*:*"],"name":"libldap-2.4-2","purl":"pkg:deb/ubuntu/libldap-2.4-2@2.4.31-1%2Bnmu2ubuntu8.2?arch=amd64&distro=ubuntu-14.04&upstream=openldap","type":"deb","version":"2.4.31-1+nmu2ubuntu8.2","language":"","licenses":["sha256:437a753e764a291167d5a1471635026e24ec2acd22cd16cc49da6d4bd50931aa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libldap-2.4-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libldap-2.4-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libldap-2.4-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openldap"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4.31-1+nmu2ubuntu8.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-9287","versionConstraint":"< 2.4.31-1+nmu2ubuntu8.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openldap","version":"2.4.31-1+nmu2ubuntu8.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-9287","fix":{"state":"fixed","versions":["2.4.31-1+nmu2ubuntu8.4"],"available":[{"date":"2017-06-01","kind":"advisory","version":"2.4.31-1+nmu2ubuntu8.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-9287","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9287","date":"2026-10-07","epss":0.07201,"percentile":0.94152}],"risk":3.6005000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-9287"},"relatedVulnerabilities":[{"id":"CVE-2017-9287","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-9287","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-9287","date":"2026-10-07","epss":0.07201,"percentile":0.94152}],"urls":["http://www.debian.org/security/2017/dsa-3868","http://www.openldap.org/its/?findid=8655","http://www.securityfocus.com/bid/98736","http://www.securitytracker.com/id/1038591","https://access.redhat.com/errata/RHSA-2017:1852","https://bugs.debian.org/863563","https://kc.mcafee.com/corporate/index?page=content&id=SB10365","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-9287","description":"servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0."}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-7979","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-7979","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"],"available":[{"date":"2016-10-05","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-7979","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7979","date":"2026-10-07","epss":0.11887,"percentile":0.96004}],"risk":3.5660999999999996,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-7979"},"relatedVulnerabilities":[{"id":"CVE-2015-7979","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-7979","cwe":"CWE-19","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7979","date":"2026-10-07","epss":0.11887,"percentile":0.96004}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176434.html","http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html","http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html","http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html","http://rhn.redhat.com/errata/RHSA-2016-1552.html","http://rhn.redhat.com/errata/RHSA-2016-2583.html","http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd","http://www.debian.org/security/2016/dsa-3629","http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","http://www.securityfocus.com/bid/81816","http://www.securitytracker.com/id/1034782","http://www.ubuntu.com/usn/USN-3096-1","https://access.redhat.com/errata/RHSA-2016:1141","https://bto.bluecoat.com/security-advisory/sa113","https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03750en_us","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03766en_us","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc","https://security.gentoo.org/glsa/201607-15","https://security.netapp.com/advisory/ntap-20171031-0001/","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11","https://www.kb.cert.org/vuls/id/718152"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-7979","description":"NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client."}]},{"artifact":{"id":"446829d742a92a16","cpes":["cpe:2.3:a:libgnutls-openssl27:libgnutls-openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-openssl27:libgnutls_openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_openssl27:libgnutls-openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_openssl27:libgnutls_openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*"],"name":"libgnutls-openssl27","purl":"pkg:deb/ubuntu/libgnutls-openssl27@2.12.23-12ubuntu2.5?arch=amd64&distro=ubuntu-14.04&upstream=gnutls26","type":"deb","version":"2.12.23-12ubuntu2.5","language":"","licenses":["sha256:12ca70c4bdcdff66bcbc6405d521f461b0cbb7bccf6d426e3ca6ef63ff132343"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-openssl27/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libgnutls-openssl27/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-openssl27:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libgnutls-openssl27:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls26"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.12.23-12ubuntu2.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5336","versionConstraint":"< 2.12.23-12ubuntu2.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnutls26","version":"2.12.23-12ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-5336","fix":{"state":"fixed","versions":["2.12.23-12ubuntu2.6"],"available":[{"date":"2017-02-01","kind":"advisory","version":"2.12.23-12ubuntu2.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5336","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5336","date":"2026-10-07","epss":0.07071,"percentile":0.94052}],"risk":3.5355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-5336"},"relatedVulnerabilities":[{"id":"CVE-2017-5336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5336","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5336","date":"2026-10-07","epss":0.07071,"percentile":0.94052}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://www.openwall.com/lists/oss-security/2017/01/10/7","http://www.openwall.com/lists/oss-security/2017/01/11/4","http://www.securityfocus.com/bid/95377","http://www.securitytracker.com/id/1037576","https://access.redhat.com/errata/RHSA-2017:2292","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=340","https://gitlab.com/gnutls/gnutls/commit/5140422e0d7319a8e2fe07f02cbcafc4d6538732","https://gnutls.org/security.html#GNUTLS-SA-2017-2","https://security.gentoo.org/glsa/201702-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5336","description":"Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate."}]},{"artifact":{"id":"45c8da2f19469884","cpes":["cpe:2.3:a:libgnutls26:libgnutls26:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*"],"name":"libgnutls26","purl":"pkg:deb/ubuntu/libgnutls26@2.12.23-12ubuntu2.5?arch=amd64&distro=ubuntu-14.04&upstream=gnutls26","type":"deb","version":"2.12.23-12ubuntu2.5","language":"","licenses":["sha256:12ca70c4bdcdff66bcbc6405d521f461b0cbb7bccf6d426e3ca6ef63ff132343"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls26/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libgnutls26/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls26:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libgnutls26:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls26"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.12.23-12ubuntu2.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5336","versionConstraint":"< 2.12.23-12ubuntu2.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnutls26","version":"2.12.23-12ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-5336","fix":{"state":"fixed","versions":["2.12.23-12ubuntu2.6"],"available":[{"date":"2017-02-01","kind":"advisory","version":"2.12.23-12ubuntu2.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5336","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5336","date":"2026-10-07","epss":0.07071,"percentile":0.94052}],"risk":3.5355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-5336"},"relatedVulnerabilities":[{"id":"CVE-2017-5336","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5336","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5336","date":"2026-10-07","epss":0.07071,"percentile":0.94052}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://www.openwall.com/lists/oss-security/2017/01/10/7","http://www.openwall.com/lists/oss-security/2017/01/11/4","http://www.securityfocus.com/bid/95377","http://www.securitytracker.com/id/1037576","https://access.redhat.com/errata/RHSA-2017:2292","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=340","https://gitlab.com/gnutls/gnutls/commit/5140422e0d7319a8e2fe07f02cbcafc4d6538732","https://gnutls.org/security.html#GNUTLS-SA-2017-2","https://security.gentoo.org/glsa/201702-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5336","description":"Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate."}]},{"artifact":{"id":"0cce56105b872ee0","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.19-0ubuntu6.9:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.19-0ubuntu6.9?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.9","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.9"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-07","epss":0.07051,"percentile":0.94035}],"risk":3.5255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-07","epss":0.07051,"percentile":0.94035}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"2a99d1b0f32aebfa","cpes":["cpe:2.3:a:libc6:libc6:2.19-0ubuntu6.9:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.19-0ubuntu6.9?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.9","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.9"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-07","epss":0.07051,"percentile":0.94035}],"risk":3.5255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-07","epss":0.07051,"percentile":0.94035}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"63846d3755a29a0c","cpes":["cpe:2.3:a:multiarch-support:multiarch-support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch-support:multiarch_support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch-support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch_support:multiarch_support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch-support:2.19-0ubuntu6.9:*:*:*:*:*:*:*","cpe:2.3:a:multiarch:multiarch_support:2.19-0ubuntu6.9:*:*:*:*:*:*:*"],"name":"multiarch-support","purl":"pkg:deb/ubuntu/multiarch-support@2.19-0ubuntu6.9?arch=amd64&distro=ubuntu-14.04&upstream=eglibc","type":"deb","version":"2.19-0ubuntu6.9","language":"","licenses":["sha256:7df93c5432380b261e276793b4ab9631834a4055009f2c6ddbdc4ee061a60be2"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/multiarch-support/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/multiarch-support/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/multiarch-support.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/multiarch-support.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/multiarch-support.list"}],"upstreams":[{"name":"eglibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-11236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"eglibc","version":"2.19-0ubuntu6.9"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-11236","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-07","epss":0.07051,"percentile":0.94035}],"risk":3.5255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-11236"},"relatedVulnerabilities":[{"id":"CVE-2018-11236","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-11236","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-11236","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-11236","date":"2026-10-07","epss":0.07051,"percentile":0.94035}],"urls":["http://www.securityfocus.com/bid/104255","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3092","https://security.netapp.com/advisory/ntap-20190329-0001/","https://security.netapp.com/advisory/ntap-20190401-0001/","https://sourceware.org/bugzilla/show_bug.cgi?id=22786","https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=5460617d1567657621107d895ee2dd83bc1f88f2","https://usn.ubuntu.com/4416-1/","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-11236","description":"stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-7167","versionConstraint":"< 7.35.0-1ubuntu2.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-7167","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.10"],"available":[{"date":"2016-11-03","kind":"advisory","version":"7.35.0-1ubuntu2.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-07","epss":0.11737,"percentile":0.95973}],"risk":3.5211,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-7167"},"relatedVulnerabilities":[{"id":"CVE-2016-7167","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-07","epss":0.11737,"percentile":0.95973}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92975","http://www.securitytracker.com/id/1036813","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.538632","https://access.redhat.com/errata/RHSA-2017:2016","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160914.html","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3IU2FRXQNU6UJIQT4NGLWWTP2GJQXO7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTH54DFOS4TSYPG5XKJDGAG4XPAR4T7M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMRWVISG7VUCYRMF23A2UHMYD72VQWAK/","https://security.gentoo.org/glsa/201701-47"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7167","description":"Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7167","versionConstraint":"< 7.35.0-1ubuntu2.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-7167","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.10"],"available":[{"date":"2016-11-03","kind":"advisory","version":"7.35.0-1ubuntu2.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-07","epss":0.11737,"percentile":0.95973}],"risk":3.5211,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-7167"},"relatedVulnerabilities":[{"id":"CVE-2016-7167","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-07","epss":0.11737,"percentile":0.95973}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92975","http://www.securitytracker.com/id/1036813","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.538632","https://access.redhat.com/errata/RHSA-2017:2016","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160914.html","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3IU2FRXQNU6UJIQT4NGLWWTP2GJQXO7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTH54DFOS4TSYPG5XKJDGAG4XPAR4T7M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMRWVISG7VUCYRMF23A2UHMYD72VQWAK/","https://security.gentoo.org/glsa/201701-47"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7167","description":"Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-7167","versionConstraint":"< 7.35.0-1ubuntu2.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-7167","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.10"],"available":[{"date":"2016-11-03","kind":"advisory","version":"7.35.0-1ubuntu2.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-07","epss":0.11737,"percentile":0.95973}],"risk":3.5211,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-7167"},"relatedVulnerabilities":[{"id":"CVE-2016-7167","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-7167","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-7167","date":"2026-10-07","epss":0.11737,"percentile":0.95973}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/92975","http://www.securitytracker.com/id/1036813","http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.538632","https://access.redhat.com/errata/RHSA-2017:2016","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20160914.html","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3IU2FRXQNU6UJIQT4NGLWWTP2GJQXO7/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTH54DFOS4TSYPG5XKJDGAG4XPAR4T7M/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZMRWVISG7VUCYRMF23A2UHMYD72VQWAK/","https://security.gentoo.org/glsa/201701-47"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-7167","description":"Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl before 7.50.3 allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow."}]},{"artifact":{"id":"9f127744e4033e99","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.8.2-1ubuntu2.1:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.8.2-1ubuntu2.1?arch=amd64&distro=ubuntu-14.04&upstream=sqlite3","type":"deb","version":"3.8.2-1ubuntu2.1","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-19926","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sqlite3","version":"3.8.2-1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-19926","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-19926","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19926","date":"2026-10-07","epss":0.06997,"percentile":0.93996}],"risk":3.4985000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-19926"},"relatedVulnerabilities":[{"id":"CVE-2019-19926","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-19926","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-19926","date":"2026-10-07","epss":0.06997,"percentile":0.93996}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html","http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html","https://access.redhat.com/errata/RHSA-2020:0514","https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://github.com/sqlite/sqlite/commit/8428b3b437569338a9d1e10c4cd8154acbe33089","https://security.netapp.com/advisory/ntap-20200114-0003/","https://usn.ubuntu.com/4298-1/","https://usn.ubuntu.com/4298-2/","https://www.debian.org/security/2020/dsa-4638","https://www.oracle.com/security-alerts/cpuapr2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-19926","description":"multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.26"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-0737","versionConstraint":"< 1.0.1f-1ubuntu2.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0737","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.26"],"available":[{"date":"2018-06-26","kind":"advisory","version":"1.0.1f-1ubuntu2.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-07","epss":0.11597,"percentile":0.95942}],"risk":3.4791000000000003,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0737"},"relatedVulnerabilities":[{"id":"CVE-2018-0737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-07","epss":0.11597,"percentile":0.95942}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103766","http://www.securitytracker.com/id/1040685","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=349a41da1ad88ad87825414752a8ff5fdd6a6c3f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6939eab03a6e23d2bd2c3f5e34fe1d48e542e787","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.netapp.com/advisory/ntap-20180726-0003/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3628-1/","https://usn.ubuntu.com/3628-2/","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180416.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0737","description":"The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o)."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.0.1f-1ubuntu2.26"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-0737","versionConstraint":"< 1.0.1f-1ubuntu2.26 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-0737","fix":{"state":"fixed","versions":["1.0.1f-1ubuntu2.26"],"available":[{"date":"2018-06-26","kind":"advisory","version":"1.0.1f-1ubuntu2.26"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-07","epss":0.11597,"percentile":0.95942}],"risk":3.4791000000000003,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-0737"},"relatedVulnerabilities":[{"id":"CVE-2018-0737","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-0737","cwe":"CWE-327","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-0737","date":"2026-10-07","epss":0.11597,"percentile":0.95942}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/103766","http://www.securitytracker.com/id/1040685","https://access.redhat.com/errata/RHSA-2018:3221","https://access.redhat.com/errata/RHSA-2018:3505","https://access.redhat.com/errata/RHSA-2019:3932","https://access.redhat.com/errata/RHSA-2019:3933","https://access.redhat.com/errata/RHSA-2019:3935","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=349a41da1ad88ad87825414752a8ff5fdd6a6c3f","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6939eab03a6e23d2bd2c3f5e34fe1d48e542e787","https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/","https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/","https://security.gentoo.org/glsa/201811-21","https://security.netapp.com/advisory/ntap-20180726-0003/","https://securityadvisories.paloaltonetworks.com/Home/Detail/133","https://usn.ubuntu.com/3628-1/","https://usn.ubuntu.com/3628-2/","https://usn.ubuntu.com/3692-1/","https://usn.ubuntu.com/3692-2/","https://www.debian.org/security/2018/dsa-4348","https://www.debian.org/security/2018/dsa-4355","https://www.openssl.org/news/secadv/20180416.txt","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","https://www.tenable.com/security/tns-2018-12","https://www.tenable.com/security/tns-2018-13","https://www.tenable.com/security/tns-2018-14","https://www.tenable.com/security/tns-2018-17"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-0737","description":"The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o)."}]},{"artifact":{"id":"3a92da38c6ecb4b5","cpes":["cpe:2.3:a:libmysqlclient18:libmysqlclient18:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"libmysqlclient18","purl":"pkg:deb/ubuntu/libmysqlclient18@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmysqlclient18/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/libmysqlclient18/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/libmysqlclient18:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2012-5627","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2012-5627","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"risk":3.4238999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2012-5627"},"relatedVulnerabilities":[{"id":"CVE-2012-5627","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"urls":["http://seclists.org/fulldisclosure/2012/Dec/58","http://seclists.org/fulldisclosure/2012/Dec/83","http://seclists.org/oss-sec/2012/q4/424","http://secunia.com/advisories/53372","http://security.gentoo.org/glsa/glsa-201308-06.xml","http://www.mandriva.com/security/advisories?name=MDVSA-2013:102","https://bugzilla.redhat.com/show_bug.cgi?id=883719","https://mariadb.atlassian.net/browse/MDEV-3915"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-5627","description":"Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks."}]},{"artifact":{"id":"36bf4de6b69a6255","cpes":["cpe:2.3:a:mysql-client-5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_5.5:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-5.5","purl":"pkg:deb/ubuntu/mysql-client-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2012-5627","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2012-5627","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"risk":3.4238999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2012-5627"},"relatedVulnerabilities":[{"id":"CVE-2012-5627","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"urls":["http://seclists.org/fulldisclosure/2012/Dec/58","http://seclists.org/fulldisclosure/2012/Dec/83","http://seclists.org/oss-sec/2012/q4/424","http://secunia.com/advisories/53372","http://security.gentoo.org/glsa/glsa-201308-06.xml","http://www.mandriva.com/security/advisories?name=MDVSA-2013:102","https://bugzilla.redhat.com/show_bug.cgi?id=883719","https://mariadb.atlassian.net/browse/MDEV-3915"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-5627","description":"Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks."}]},{"artifact":{"id":"0cc2725ab23d1488","cpes":["cpe:2.3:a:mysql-client-core-5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_5.5:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-5.5","purl":"pkg:deb/ubuntu/mysql-client-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-client-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-client-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2012-5627","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2012-5627","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"risk":3.4238999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2012-5627"},"relatedVulnerabilities":[{"id":"CVE-2012-5627","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"urls":["http://seclists.org/fulldisclosure/2012/Dec/58","http://seclists.org/fulldisclosure/2012/Dec/83","http://seclists.org/oss-sec/2012/q4/424","http://secunia.com/advisories/53372","http://security.gentoo.org/glsa/glsa-201308-06.xml","http://www.mandriva.com/security/advisories?name=MDVSA-2013:102","https://bugzilla.redhat.com/show_bug.cgi?id=883719","https://mariadb.atlassian.net/browse/MDEV-3915"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-5627","description":"Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks."}]},{"artifact":{"id":"3b403ffe87a53deb","cpes":["cpe:2.3:a:mysql-common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2012-5627","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2012-5627","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"risk":3.4238999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2012-5627"},"relatedVulnerabilities":[{"id":"CVE-2012-5627","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"urls":["http://seclists.org/fulldisclosure/2012/Dec/58","http://seclists.org/fulldisclosure/2012/Dec/83","http://seclists.org/oss-sec/2012/q4/424","http://secunia.com/advisories/53372","http://security.gentoo.org/glsa/glsa-201308-06.xml","http://www.mandriva.com/security/advisories?name=MDVSA-2013:102","https://bugzilla.redhat.com/show_bug.cgi?id=883719","https://mariadb.atlassian.net/browse/MDEV-3915"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-5627","description":"Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks."}]},{"artifact":{"id":"afab8ee844fe81c2","cpes":["cpe:2.3:a:mysql-server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server","purl":"pkg:deb/ubuntu/mysql-server@5.5.58-0ubuntu0.14.04.1?arch=all&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2012-5627","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2012-5627","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"risk":3.4238999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2012-5627"},"relatedVulnerabilities":[{"id":"CVE-2012-5627","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"urls":["http://seclists.org/fulldisclosure/2012/Dec/58","http://seclists.org/fulldisclosure/2012/Dec/83","http://seclists.org/oss-sec/2012/q4/424","http://secunia.com/advisories/53372","http://security.gentoo.org/glsa/glsa-201308-06.xml","http://www.mandriva.com/security/advisories?name=MDVSA-2013:102","https://bugzilla.redhat.com/show_bug.cgi?id=883719","https://mariadb.atlassian.net/browse/MDEV-3915"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-5627","description":"Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks."}]},{"artifact":{"id":"5f265bbfa54385b1","cpes":["cpe:2.3:a:mysql-server-5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_5.5:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-5.5","purl":"pkg:deb/ubuntu/mysql-server-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-5.5.config","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.config"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.list"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.postrm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.postrm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.preinst","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.preinst"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.prerm","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.prerm"},{"path":"/var/lib/dpkg/info/mysql-server-5.5.templates","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-5.5.templates"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2012-5627","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2012-5627","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"risk":3.4238999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2012-5627"},"relatedVulnerabilities":[{"id":"CVE-2012-5627","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"urls":["http://seclists.org/fulldisclosure/2012/Dec/58","http://seclists.org/fulldisclosure/2012/Dec/83","http://seclists.org/oss-sec/2012/q4/424","http://secunia.com/advisories/53372","http://security.gentoo.org/glsa/glsa-201308-06.xml","http://www.mandriva.com/security/advisories?name=MDVSA-2013:102","https://bugzilla.redhat.com/show_bug.cgi?id=883719","https://mariadb.atlassian.net/browse/MDEV-3915"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-5627","description":"Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks."}]},{"artifact":{"id":"0a50820cc2c0d7fa","cpes":["cpe:2.3:a:mysql-server-core-5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_5.5:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_5.5:5.5.58-0ubuntu0.14.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-5.5","purl":"pkg:deb/ubuntu/mysql-server-core-5.5@5.5.58-0ubuntu0.14.04.1?arch=amd64&distro=ubuntu-14.04&upstream=mysql-5.5","type":"deb","version":"5.5.58-0ubuntu0.14.04.1","language":"","licenses":["Artistic","BSD","BSD-like","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","SWsoft","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-5.5/copyright","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/usr/share/doc/mysql-server-core-5.5/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-5.5.list","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/info/mysql-server-core-5.5.list"}],"upstreams":[{"name":"mysql-5.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2012-5627","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"mysql-5.5","version":"5.5.58-0ubuntu0.14.04.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2012-5627","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"risk":3.4238999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2012-5627"},"relatedVulnerabilities":[{"id":"CVE-2012-5627","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","metrics":{"baseScore":4,"impactScore":2.9,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2012-5627","cwe":"CWE-522","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2012-5627","date":"2026-10-07","epss":0.11413,"percentile":0.959}],"urls":["http://seclists.org/fulldisclosure/2012/Dec/58","http://seclists.org/fulldisclosure/2012/Dec/83","http://seclists.org/oss-sec/2012/q4/424","http://secunia.com/advisories/53372","http://security.gentoo.org/glsa/glsa-201308-06.xml","http://www.mandriva.com/security/advisories?name=MDVSA-2013:102","https://bugzilla.redhat.com/show_bug.cgi?id=883719","https://mariadb.atlassian.net/browse/MDEV-3915"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2012-5627","description":"Oracle MySQL and MariaDB 5.5.x before 5.5.29, 5.3.x before 5.3.12, and 5.2.x before 5.2.14 does not modify the salt during multiple executions of the change_user command within the same connection which makes it easier for remote authenticated users to conduct brute force password guessing attacks."}]},{"artifact":{"id":"71081c257357e0b6","cpes":["cpe:2.3:a:perl:perl:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-07","epss":0.11334,"percentile":0.95882}],"risk":3.4002,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-10543"},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-07","epss":0.11334,"percentile":0.95882}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"b6e547621bce8e70","cpes":["cpe:2.3:a:perl-base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-07","epss":0.11334,"percentile":0.95882}],"risk":3.4002,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-10543"},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-07","epss":0.11334,"percentile":0.95882}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"9a3f82ec97b0252b","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/ubuntu/perl-modules@5.18.2-2ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-10543","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-10543","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-07","epss":0.11334,"percentile":0.95882}],"risk":3.4002,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-10543"},"relatedVulnerabilities":[{"id":"CVE-2020-10543","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-10543","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2020-10543","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-10543","date":"2026-10-07","epss":0.11334,"percentile":0.95882}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","https://security.gentoo.org/glsa/202006-03","https://security.netapp.com/advisory/ntap-20200611-0001/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","description":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow."}]},{"artifact":{"id":"328fe217962e5779","cpes":["cpe:2.3:a:sudo:sudo:1.8.9p5-1ubuntu1.2:*:*:*:*:*:*:*"],"name":"sudo","purl":"pkg:deb/ubuntu/sudo@1.8.9p5-1ubuntu1.2?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.8.9p5-1ubuntu1.2","language":"","licenses":["BSD-3-Clause","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/sudo/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/sudo/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/sudo.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.list"},{"path":"/var/lib/dpkg/info/sudo.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.postinst"},{"path":"/var/lib/dpkg/info/sudo.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.postrm"},{"path":"/var/lib/dpkg/info/sudo.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.preinst"},{"path":"/var/lib/dpkg/info/sudo.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/sudo.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-32462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"sudo","version":"1.8.9p5-1ubuntu1.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2025-32462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-32462","cwe":"CWE-863","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-32462","date":"2026-10-07","epss":0.04477,"percentile":0.91196}],"risk":3.35775,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32462"},"relatedVulnerabilities":[{"id":"CVE-2025-32462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":6.1,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N","metrics":{"baseScore":2.8,"impactScore":1.5,"exploitabilityScore":1.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32462","cwe":"CWE-863","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-32462","date":"2026-10-07","epss":0.04477,"percentile":0.91196}],"urls":["https://access.redhat.com/security/cve/cve-2025-32462","https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32462","https://explore.alas.aws.amazon.com/CVE-2025-32462.html","https://lists.debian.org/debian-security-announce/2025/msg00118.html","https://security-tracker.debian.org/tracker/CVE-2025-32462","https://ubuntu.com/security/notices/USN-7604-1","https://www.openwall.com/lists/oss-security/2025/06/30/2","https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/","https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host","https://www.sudo.ws/releases/changelog/","https://www.sudo.ws/security/advisories/","https://www.sudo.ws/security/advisories/host_any/","https://www.suse.com/security/cve/CVE-2025-32462.html","https://lists.debian.org/debian-lts-announce/2025/06/msg00033.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32462","description":"Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines."}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9311","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-9311","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.11"],"available":[{"date":"2017-07-05","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-9311","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9311","date":"2026-10-07","epss":0.11174,"percentile":0.9585}],"risk":3.3522000000000003,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-9311"},"relatedVulnerabilities":[{"id":"CVE-2016-9311","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.1,"impactScore":6.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9311","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9311","date":"2026-10-07","epss":0.11174,"percentile":0.9585}],"urls":["http://nwtime.org/ntp428p9_release/","http://rhn.redhat.com/errata/RHSA-2017-0252.html","http://support.ntp.org/bin/view/Main/NtpBug3119","http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities","http://www.securityfocus.com/bid/94444","http://www.securitytracker.com/id/1037354","https://bto.bluecoat.com/security-advisory/sa139","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03706en_us","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:39.ntp.asc","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03799en_us","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03885en_us","https://usn.ubuntu.com/3707-2/","https://www.kb.cert.org/vuls/id/633847"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9311","description":"ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet."}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.11"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-9310","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.11 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-9310","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.11"],"available":[{"date":"2017-07-05","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.11"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-9310","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9310","date":"2026-10-07","epss":0.11162,"percentile":0.95847}],"risk":3.3485999999999994,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-9310"},"relatedVulnerabilities":[{"id":"CVE-2016-9310","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-9310","cwe":"CWE-400","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-9310","date":"2026-10-07","epss":0.11162,"percentile":0.95847}],"urls":["http://nwtime.org/ntp428p9_release/","http://rhn.redhat.com/errata/RHSA-2017-0252.html","http://support.ntp.org/bin/view/Main/NtpBug3118","http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities","http://www.securityfocus.com/bid/94452","http://www.securitytracker.com/id/1037354","https://bto.bluecoat.com/security-advisory/sa139","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03706en_us","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:39.ntp.asc","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03799en_us","https://usn.ubuntu.com/3707-2/","https://www.kb.cert.org/vuls/id/633847"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-9310","description":"The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet."}]},{"artifact":{"id":"df1837354f8ead15","cpes":["cpe:2.3:a:libexpat1:libexpat1:2.1.0-4ubuntu1.3:*:*:*:*:*:*:*"],"name":"libexpat1","purl":"pkg:deb/ubuntu/libexpat1@2.1.0-4ubuntu1.3?arch=amd64&distro=ubuntu-14.04&upstream=expat","type":"deb","version":"2.1.0-4ubuntu1.3","language":"","licenses":["MIT"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libexpat1/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libexpat1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libexpat1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"expat"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-15903","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"expat","version":"2.1.0-4ubuntu1.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-15903","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-15903","date":"2026-10-07","epss":0.06643,"percentile":0.937}],"risk":3.3215000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-15903"},"relatedVulnerabilities":[{"id":"CVE-2019-15903","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-776","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-15903","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-15903","date":"2026-10-07","epss":0.06643,"percentile":0.937}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00080.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00081.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00000.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00003.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00013.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00016.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00017.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00018.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00019.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00008.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html","http://seclists.org/fulldisclosure/2019/Dec/23","http://seclists.org/fulldisclosure/2019/Dec/26","http://seclists.org/fulldisclosure/2019/Dec/27","http://seclists.org/fulldisclosure/2019/Dec/30","https://access.redhat.com/errata/RHSA-2019:3210","https://access.redhat.com/errata/RHSA-2019:3237","https://access.redhat.com/errata/RHSA-2019:3756","https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43","https://github.com/libexpat/libexpat/issues/317","https://github.com/libexpat/libexpat/issues/342","https://github.com/libexpat/libexpat/pull/318","https://lists.debian.org/debian-lts-announce/2019/11/msg00006.html","https://lists.debian.org/debian-lts-announce/2019/11/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A4TZKPJFTURRLXIGLB34WVKQ5HGY6JJA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BDUTI5TVQWIGGQXPEVI4T2ENHFSBMIBP/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S26LGXXQ7YF2BP3RGOWELBFKM6BHF6UG/","https://seclists.org/bugtraq/2019/Dec/17","https://seclists.org/bugtraq/2019/Dec/21","https://seclists.org/bugtraq/2019/Dec/23","https://seclists.org/bugtraq/2019/Nov/1","https://seclists.org/bugtraq/2019/Nov/24","https://seclists.org/bugtraq/2019/Oct/29","https://seclists.org/bugtraq/2019/Sep/30","https://seclists.org/bugtraq/2019/Sep/37","https://security.gentoo.org/glsa/201911-08","https://security.netapp.com/advisory/ntap-20190926-0004/","https://support.apple.com/kb/HT210785","https://support.apple.com/kb/HT210788","https://support.apple.com/kb/HT210789","https://support.apple.com/kb/HT210790","https://support.apple.com/kb/HT210793","https://support.apple.com/kb/HT210794","https://support.apple.com/kb/HT210795","https://usn.ubuntu.com/4132-1/","https://usn.ubuntu.com/4132-2/","https://usn.ubuntu.com/4165-1/","https://usn.ubuntu.com/4202-1/","https://usn.ubuntu.com/4335-1/","https://www.debian.org/security/2019/dsa-4530","https://www.debian.org/security/2019/dsa-4549","https://www.debian.org/security/2019/dsa-4571","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://www.tenable.com/security/tns-2021-11"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-15903","description":"In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read."}]},{"artifact":{"id":"2a5e71579caea51d","cpes":["cpe:2.3:a:libidn11:libidn11:1.28-1ubuntu2:*:*:*:*:*:*:*"],"name":"libidn11","purl":"pkg:deb/ubuntu/libidn11@1.28-1ubuntu2?arch=amd64&distro=ubuntu-14.04&upstream=libidn","type":"deb","version":"1.28-1ubuntu2","language":"","licenses":["GAP","GFDL-1.3","GFDL-1.3+","GPL-2","GPL-3","GPL-3+","LGPL-2","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libidn11/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libidn11/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libidn11:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libidn11:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libidn"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.28-1ubuntu2.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6262","versionConstraint":"< 1.28-1ubuntu2.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libidn","version":"1.28-1ubuntu2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6262","fix":{"state":"fixed","versions":["1.28-1ubuntu2.1"],"available":[{"date":"2016-08-24","kind":"advisory","version":"1.28-1ubuntu2.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6262","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6262","date":"2026-10-07","epss":0.06513,"percentile":0.93599}],"risk":3.2564999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6262"},"relatedVulnerabilities":[{"id":"CVE-2016-6262","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6262","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6262","date":"2026-10-07","epss":0.06513,"percentile":0.93599}],"urls":["http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=5e3cb9c7b5bf0ce665b9d68f5ddf095af5c9ba60","http://lists.opensuse.org/opensuse-updates/2016-08/msg00005.html","http://lists.opensuse.org/opensuse-updates/2016-08/msg00098.html","http://www.openwall.com/lists/oss-security/2016/07/20/6","http://www.openwall.com/lists/oss-security/2016/07/21/4","http://www.securityfocus.com/bid/92070","http://www.ubuntu.com/usn/USN-3068-1","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.gnu.org/archive/html/help-libidn/2016-07/msg00009.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6262","description":"idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948."}]},{"artifact":{"id":"71081c257357e0b6","cpes":["cpe:2.3:a:perl:perl:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-6797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-6797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-07","epss":0.06477,"percentile":0.93572}],"risk":3.2384999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-6797"},"relatedVulnerabilities":[{"id":"CVE-2018-6797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-07","epss":0.06477,"percentile":0.93572}],"urls":["http://www.securitytracker.com/id/1040681","http://www.securitytracker.com/id/1042004","https://access.redhat.com/errata/RHSA-2018:1192","https://rt.perl.org/Public/Bug/Display.html?id=132227","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6797","description":"An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written."}]},{"artifact":{"id":"b6e547621bce8e70","cpes":["cpe:2.3:a:perl-base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-6797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-07","epss":0.06477,"percentile":0.93572}],"risk":3.2384999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-6797"},"relatedVulnerabilities":[{"id":"CVE-2018-6797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-07","epss":0.06477,"percentile":0.93572}],"urls":["http://www.securitytracker.com/id/1040681","http://www.securitytracker.com/id/1042004","https://access.redhat.com/errata/RHSA-2018:1192","https://rt.perl.org/Public/Bug/Display.html?id=132227","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6797","description":"An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written."}]},{"artifact":{"id":"9a3f82ec97b0252b","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/ubuntu/perl-modules@5.18.2-2ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-6797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-6797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-07","epss":0.06477,"percentile":0.93572}],"risk":3.2384999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-6797"},"relatedVulnerabilities":[{"id":"CVE-2018-6797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-6797","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-6797","date":"2026-10-07","epss":0.06477,"percentile":0.93572}],"urls":["http://www.securitytracker.com/id/1040681","http://www.securitytracker.com/id/1042004","https://access.redhat.com/errata/RHSA-2018:1192","https://rt.perl.org/Public/Bug/Display.html?id=132227","https://security.gentoo.org/glsa/201909-01","https://usn.ubuntu.com/3625-1/","https://www.debian.org/security/2018/dsa-4172","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-6797","description":"An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written."}]},{"artifact":{"id":"0e8ff27bbef37560","cpes":["cpe:2.3:a:libasn1-8-heimdal:libasn1-8-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libasn1-8-heimdal:libasn1_8_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libasn1_8_heimdal:libasn1-8-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libasn1_8_heimdal:libasn1_8_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libasn1-8:libasn1-8-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libasn1-8:libasn1_8_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libasn1_8:libasn1-8-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libasn1_8:libasn1_8_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libasn1:libasn1-8-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libasn1:libasn1_8_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*"],"name":"libasn1-8-heimdal","purl":"pkg:deb/ubuntu/libasn1-8-heimdal@1.6~git20131207%2Bdfsg-1ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=heimdal","type":"deb","version":"1.6~git20131207+dfsg-1ubuntu1.1","language":"","licenses":["sha256:9cb03c48e251d03d4a595decdd185ad04385f4d1a80b371924bc17280badd112"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libasn1-8-heimdal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libasn1-8-heimdal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libasn1-8-heimdal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libasn1-8-heimdal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"heimdal"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"heimdal","version":"1.6~git20131207+dfsg-1ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"5729611933088ab4","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.12%2Bdfsg-2ubuntu5.2?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"f1dbfc77d6f9f1c3","cpes":["cpe:2.3:a:libgssapi3-heimdal:libgssapi3-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi3-heimdal:libgssapi3_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi3_heimdal:libgssapi3-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi3_heimdal:libgssapi3_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi3:libgssapi3-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi3:libgssapi3_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*"],"name":"libgssapi3-heimdal","purl":"pkg:deb/ubuntu/libgssapi3-heimdal@1.6~git20131207%2Bdfsg-1ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=heimdal","type":"deb","version":"1.6~git20131207+dfsg-1ubuntu1.1","language":"","licenses":["sha256:9cb03c48e251d03d4a595decdd185ad04385f4d1a80b371924bc17280badd112"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi3-heimdal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libgssapi3-heimdal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi3-heimdal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libgssapi3-heimdal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"heimdal"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"heimdal","version":"1.6~git20131207+dfsg-1ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"0ab36fb114c64865","cpes":["cpe:2.3:a:libhcrypto4-heimdal:libhcrypto4-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhcrypto4-heimdal:libhcrypto4_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhcrypto4_heimdal:libhcrypto4-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhcrypto4_heimdal:libhcrypto4_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhcrypto4:libhcrypto4-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhcrypto4:libhcrypto4_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*"],"name":"libhcrypto4-heimdal","purl":"pkg:deb/ubuntu/libhcrypto4-heimdal@1.6~git20131207%2Bdfsg-1ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=heimdal","type":"deb","version":"1.6~git20131207+dfsg-1ubuntu1.1","language":"","licenses":["sha256:9cb03c48e251d03d4a595decdd185ad04385f4d1a80b371924bc17280badd112"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libhcrypto4-heimdal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libhcrypto4-heimdal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libhcrypto4-heimdal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libhcrypto4-heimdal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"heimdal"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"heimdal","version":"1.6~git20131207+dfsg-1ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"f5cb2783d0b03442","cpes":["cpe:2.3:a:libheimbase1-heimdal:libheimbase1-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libheimbase1-heimdal:libheimbase1_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libheimbase1_heimdal:libheimbase1-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libheimbase1_heimdal:libheimbase1_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libheimbase1:libheimbase1-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libheimbase1:libheimbase1_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*"],"name":"libheimbase1-heimdal","purl":"pkg:deb/ubuntu/libheimbase1-heimdal@1.6~git20131207%2Bdfsg-1ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=heimdal","type":"deb","version":"1.6~git20131207+dfsg-1ubuntu1.1","language":"","licenses":["sha256:9cb03c48e251d03d4a595decdd185ad04385f4d1a80b371924bc17280badd112"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheimbase1-heimdal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libheimbase1-heimdal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheimbase1-heimdal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libheimbase1-heimdal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"heimdal"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"heimdal","version":"1.6~git20131207+dfsg-1ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"1168ec1f8b3222f5","cpes":["cpe:2.3:a:libheimntlm0-heimdal:libheimntlm0-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libheimntlm0-heimdal:libheimntlm0_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libheimntlm0_heimdal:libheimntlm0-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libheimntlm0_heimdal:libheimntlm0_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libheimntlm0:libheimntlm0-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libheimntlm0:libheimntlm0_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*"],"name":"libheimntlm0-heimdal","purl":"pkg:deb/ubuntu/libheimntlm0-heimdal@1.6~git20131207%2Bdfsg-1ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=heimdal","type":"deb","version":"1.6~git20131207+dfsg-1ubuntu1.1","language":"","licenses":["sha256:9cb03c48e251d03d4a595decdd185ad04385f4d1a80b371924bc17280badd112"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libheimntlm0-heimdal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libheimntlm0-heimdal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libheimntlm0-heimdal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libheimntlm0-heimdal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"heimdal"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"heimdal","version":"1.6~git20131207+dfsg-1ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"630cf0a01ed01186","cpes":["cpe:2.3:a:libhx509-5-heimdal:libhx509-5-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhx509-5-heimdal:libhx509_5_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhx509_5_heimdal:libhx509-5-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhx509_5_heimdal:libhx509_5_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhx509-5:libhx509-5-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhx509-5:libhx509_5_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhx509_5:libhx509-5-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhx509_5:libhx509_5_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhx509:libhx509-5-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libhx509:libhx509_5_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*"],"name":"libhx509-5-heimdal","purl":"pkg:deb/ubuntu/libhx509-5-heimdal@1.6~git20131207%2Bdfsg-1ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=heimdal","type":"deb","version":"1.6~git20131207+dfsg-1ubuntu1.1","language":"","licenses":["sha256:9cb03c48e251d03d4a595decdd185ad04385f4d1a80b371924bc17280badd112"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libhx509-5-heimdal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libhx509-5-heimdal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libhx509-5-heimdal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libhx509-5-heimdal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"heimdal"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"heimdal","version":"1.6~git20131207+dfsg-1ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"ce758c0024b5fdb9","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.12%2Bdfsg-2ubuntu5.2?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"53cd056f89de4b09","cpes":["cpe:2.3:a:libkrb5-26-heimdal:libkrb5-26-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-26-heimdal:libkrb5_26_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_26_heimdal:libkrb5-26-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_26_heimdal:libkrb5_26_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-26:libkrb5-26-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-26:libkrb5_26_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_26:libkrb5-26-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_26:libkrb5_26_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-26-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_26_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*"],"name":"libkrb5-26-heimdal","purl":"pkg:deb/ubuntu/libkrb5-26-heimdal@1.6~git20131207%2Bdfsg-1ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=heimdal","type":"deb","version":"1.6~git20131207+dfsg-1ubuntu1.1","language":"","licenses":["sha256:9cb03c48e251d03d4a595decdd185ad04385f4d1a80b371924bc17280badd112"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-26-heimdal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libkrb5-26-heimdal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-26-heimdal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libkrb5-26-heimdal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"heimdal"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"heimdal","version":"1.6~git20131207+dfsg-1ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"9a9b8e1c27a04422","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.12%2Bdfsg-2ubuntu5.2?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"33e67ade259e89cd","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.12\\+dfsg-2ubuntu5.2:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.12%2Bdfsg-2ubuntu5.2?arch=amd64&distro=ubuntu-14.04&upstream=krb5","type":"deb","version":"1.12+dfsg-2ubuntu5.2","language":"","licenses":["sha256:7fcf9ea67f5dae48cb9cca170f274c549502b5cf436ef468eec4ea7353a9a05a"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"krb5","version":"1.12+dfsg-2ubuntu5.2"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"ef246778a9fe87fb","cpes":["cpe:2.3:a:libroken18-heimdal:libroken18-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libroken18-heimdal:libroken18_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libroken18_heimdal:libroken18-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libroken18_heimdal:libroken18_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libroken18:libroken18-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libroken18:libroken18_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*"],"name":"libroken18-heimdal","purl":"pkg:deb/ubuntu/libroken18-heimdal@1.6~git20131207%2Bdfsg-1ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=heimdal","type":"deb","version":"1.6~git20131207+dfsg-1ubuntu1.1","language":"","licenses":["sha256:9cb03c48e251d03d4a595decdd185ad04385f4d1a80b371924bc17280badd112"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libroken18-heimdal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libroken18-heimdal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libroken18-heimdal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libroken18-heimdal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"heimdal"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"heimdal","version":"1.6~git20131207+dfsg-1ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"ca73d20d27e57326","cpes":["cpe:2.3:a:libwind0-heimdal:libwind0-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libwind0-heimdal:libwind0_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libwind0_heimdal:libwind0-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libwind0_heimdal:libwind0_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libwind0:libwind0-heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:libwind0:libwind0_heimdal:1.6\\~git20131207\\+dfsg-1ubuntu1.1:*:*:*:*:*:*:*"],"name":"libwind0-heimdal","purl":"pkg:deb/ubuntu/libwind0-heimdal@1.6~git20131207%2Bdfsg-1ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=heimdal","type":"deb","version":"1.6~git20131207+dfsg-1ubuntu1.1","language":"","licenses":["sha256:9cb03c48e251d03d4a595decdd185ad04385f4d1a80b371924bc17280badd112"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libwind0-heimdal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libwind0-heimdal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libwind0-heimdal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libwind0-heimdal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"heimdal"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-42898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"heimdal","version":"1.6~git20131207+dfsg-1ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-42898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"risk":3.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-42898"},"relatedVulnerabilities":[{"id":"CVE-2022-42898","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-42898","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-42898","date":"2026-10-07","epss":0.06473,"percentile":0.9357}],"urls":["https://bugzilla.samba.org/show_bug.cgi?id=15203","https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c","https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583","https://security.gentoo.org/glsa/202309-06","https://security.gentoo.org/glsa/202310-06","https://security.netapp.com/advisory/ntap-20230216-0008/","https://security.netapp.com/advisory/ntap-20230223-0001/","https://web.mit.edu/kerberos/advisories/","https://web.mit.edu/kerberos/krb5-1.19/","https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt","https://www.samba.org/samba/security/CVE-2022-42898.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-42898","description":"PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has \"a similar bug.\""}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-26116","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-26116","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-07","epss":0.06358,"percentile":0.93469}],"risk":3.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-26116"},"relatedVulnerabilities":[{"id":"CVE-2020-26116","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-07","epss":0.06358,"percentile":0.93469}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.html","https://bugs.python.org/issue39603","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDQ2THWU4GPV4Y5H5WW5PFMSWXL2CRFD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWMAVY4T4257AZHTF2RZJKNJNSJFY24O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOX7DGMMWWL6POCRYGAUCISOLR2IG3XV/","https://python-security.readthedocs.io/vuln/http-header-injection-method.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20201023-0001/","https://usn.ubuntu.com/4581-1/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-26116","description":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-26116","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-26116","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-07","epss":0.06358,"percentile":0.93469}],"risk":3.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-26116"},"relatedVulnerabilities":[{"id":"CVE-2020-26116","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-07","epss":0.06358,"percentile":0.93469}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.html","https://bugs.python.org/issue39603","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDQ2THWU4GPV4Y5H5WW5PFMSWXL2CRFD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWMAVY4T4257AZHTF2RZJKNJNSJFY24O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOX7DGMMWWL6POCRYGAUCISOLR2IG3XV/","https://python-security.readthedocs.io/vuln/http-header-injection-method.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20201023-0001/","https://usn.ubuntu.com/4581-1/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-26116","description":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2020-26116","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-26116","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-07","epss":0.06358,"percentile":0.93469}],"risk":3.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-26116"},"relatedVulnerabilities":[{"id":"CVE-2020-26116","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-07","epss":0.06358,"percentile":0.93469}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.html","https://bugs.python.org/issue39603","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDQ2THWU4GPV4Y5H5WW5PFMSWXL2CRFD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWMAVY4T4257AZHTF2RZJKNJNSJFY24O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOX7DGMMWWL6POCRYGAUCISOLR2IG3XV/","https://python-security.readthedocs.io/vuln/http-header-injection-method.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20201023-0001/","https://usn.ubuntu.com/4581-1/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-26116","description":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2020-26116","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2020-26116","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-07","epss":0.06358,"percentile":0.93469}],"risk":3.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2020-26116"},"relatedVulnerabilities":[{"id":"CVE-2020-26116","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","metrics":{"baseScore":7.2,"impactScore":2.8,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2020-26116","cwe":"CWE-74","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2020-26116","date":"2026-10-07","epss":0.06358,"percentile":0.93469}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00027.html","https://bugs.python.org/issue39603","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BW4GCLQISJCOEGQNIMVUZDQMIY6RR6CC/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HDQ2THWU4GPV4Y5H5WW5PFMSWXL2CRFD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWMAVY4T4257AZHTF2RZJKNJNSJFY24O/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QOX7DGMMWWL6POCRYGAUCISOLR2IG3XV/","https://python-security.readthedocs.io/vuln/http-header-injection-method.html","https://security.gentoo.org/glsa/202101-18","https://security.netapp.com/advisory/ntap-20201023-0001/","https://usn.ubuntu.com/4581-1/","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-26116","description":"http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request."}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-7977","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-7977","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"],"available":[{"date":"2016-10-05","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-7977","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7977","date":"2026-10-07","epss":0.06346,"percentile":0.93459}],"risk":3.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-7977"},"relatedVulnerabilities":[{"id":"CVE-2015-7977","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-7977","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-7977","date":"2026-10-07","epss":0.06346,"percentile":0.93459}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176434.html","http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html","http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html","http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html","http://rhn.redhat.com/errata/RHSA-2016-0780.html","http://rhn.redhat.com/errata/RHSA-2016-2583.html","http://support.ntp.org/bin/view/Main/NtpBug2939","http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd","http://www.debian.org/security/2016/dsa-3629","http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","http://www.securityfocus.com/bid/81815","http://www.securitytracker.com/id/1034782","http://www.ubuntu.com/usn/USN-3096-1","https://bto.bluecoat.com/security-advisory/sa113","https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc","https://security.gentoo.org/glsa/201607-15","https://security.netapp.com/advisory/ntap-20171031-0001/","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11","https://www.kb.cert.org/vuls/id/718152"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-7977","description":"ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-22924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-22924","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-22924","cwe":"CWE-20","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22924","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22924","date":"2026-10-07","epss":0.0627,"percentile":0.93394}],"risk":3.1350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-22924"},"relatedVulnerabilities":[{"id":"CVE-2021-22924","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22924","cwe":"CWE-20","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22924","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22924","date":"2026-10-07","epss":0.0627,"percentile":0.93394}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf","https://hackerone.com/reports/1223565","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/","https://security.netapp.com/advisory/ntap-20210902-0003/","https://www.debian.org/security/2022/dsa-5197","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-22924","description":"libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-22924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-22924","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-22924","cwe":"CWE-20","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22924","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22924","date":"2026-10-07","epss":0.0627,"percentile":0.93394}],"risk":3.1350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-22924"},"relatedVulnerabilities":[{"id":"CVE-2021-22924","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22924","cwe":"CWE-20","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22924","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22924","date":"2026-10-07","epss":0.0627,"percentile":0.93394}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf","https://hackerone.com/reports/1223565","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/","https://security.netapp.com/advisory/ntap-20210902-0003/","https://www.debian.org/security/2022/dsa-5197","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-22924","description":"libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-22924","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-22924","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-22924","cwe":"CWE-20","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22924","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22924","date":"2026-10-07","epss":0.0627,"percentile":0.93394}],"risk":3.1350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-22924"},"relatedVulnerabilities":[{"id":"CVE-2021-22924","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-22924","cwe":"CWE-20","type":"Secondary","source":"support@hackerone.com"},{"cve":"CVE-2021-22924","cwe":"CWE-706","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-22924","date":"2026-10-07","epss":0.0627,"percentile":0.93394}],"urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-732250.pdf","https://hackerone.com/reports/1223565","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E","https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E","https://lists.debian.org/debian-lts-announce/2021/08/msg00017.html","https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/","https://security.netapp.com/advisory/ntap-20210902-0003/","https://www.debian.org/security/2022/dsa-5197","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-22924","description":"libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching function did not take 'issuercert' into account and it compared the involved paths *case insensitively*,which could lead to libcurl reusing wrong connections.File paths are, or can be, case sensitive on many systems but not all, and caneven vary depending on used file systems.The comparison also didn't include the 'issuer cert' which a transfer can setto qualify how to verify the server certificate."}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-8138","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-8138","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"],"available":[{"date":"2016-10-05","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-8138","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-8138","date":"2026-10-07","epss":0.06255,"percentile":0.93382}],"risk":3.1274999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-8138"},"relatedVulnerabilities":[{"id":"CVE-2015-8138","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-8138","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-8138","date":"2026-10-07","epss":0.06255,"percentile":0.93382}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html","http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176434.html","http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html","http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html","http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html","http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html","http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html","http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html","http://rhn.redhat.com/errata/RHSA-2016-0063.html","http://support.ntp.org/bin/view/Main/SecurityNotice#April_2016_NTP_4_2_8p7_Security","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd","http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160428-ntpd","http://www.debian.org/security/2016/dsa-3629","http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","http://www.securityfocus.com/bid/81811","http://www.securitytracker.com/id/1034782","http://www.ubuntu.com/usn/USN-3096-1","https://bto.bluecoat.com/security-advisory/sa113","https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-497656.pdf","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03750en_us","https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03766en_us","https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc","https://security.gentoo.org/glsa/201607-15","https://security.netapp.com/advisory/ntap-20171004-0002/","https://security.netapp.com/advisory/ntap-20171031-0001/","https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161123-ntpd","https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11","https://www.arista.com/en/support/advisories-notices/security-advisories/1332-security-advisory-19","https://www.kb.cert.org/vuls/id/718152"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-8138","description":"NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-20907","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-20907","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-07","epss":0.06253,"percentile":0.93381}],"risk":3.1265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-20907"},"relatedVulnerabilities":[{"id":"CVE-2019-20907","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-07","epss":0.06253,"percentile":0.93381}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html","https://bugs.python.org/issue39017","https://github.com/python/cpython/pull/21454","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200731-0002/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20907","description":"In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-20907","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-20907","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-07","epss":0.06253,"percentile":0.93381}],"risk":3.1265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-20907"},"relatedVulnerabilities":[{"id":"CVE-2019-20907","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-07","epss":0.06253,"percentile":0.93381}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html","https://bugs.python.org/issue39017","https://github.com/python/cpython/pull/21454","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200731-0002/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20907","description":"In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-20907","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-20907","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-07","epss":0.06253,"percentile":0.93381}],"risk":3.1265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-20907"},"relatedVulnerabilities":[{"id":"CVE-2019-20907","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-07","epss":0.06253,"percentile":0.93381}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html","https://bugs.python.org/issue39017","https://github.com/python/cpython/pull/21454","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200731-0002/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20907","description":"In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-20907","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-20907","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-07","epss":0.06253,"percentile":0.93381}],"risk":3.1265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-20907"},"relatedVulnerabilities":[{"id":"CVE-2019-20907","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-20907","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-20907","date":"2026-10-07","epss":0.06253,"percentile":0.93381}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html","http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00056.html","https://bugs.python.org/issue39017","https://github.com/python/cpython/pull/21454","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00032.html","https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36XI3EEQNMHGOZEI63Y7UV6XZRELYEAU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAXHCY4V3LPAAJOBCJ26ISZ4NUXQXTUZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNHPQGSP2YM3JAUD2VAMPXTIUQTZ2M2U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CTUNTBJ3POHONQOTLEZC46POCIYYTAKZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LE4O3PNDNNOMSKHNUKZKD3NGHIFUFDPX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NTBKKOLFFNHG6CM4ACDX4APHSD5ZX5N4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXI72HIHMXCQFWTULUXDG7VDA2BCYL4Y/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PDKKRXLNVXRF6VGERZSR3OMQR5D5QI6I/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TOGKLGTXZLHQQFBVCAPSUDA6DOOJFNRY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V3TALOUBYU2MQD4BPLRTDQUMBKGCAXUA/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V53P2YOLEQH4J7S5QHXMKMZYFTVVMTMO/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT4AF72TJ2XNIKCR4WEBR7URBJJ4YZRD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YILCHHTNLH4GG4GSQBX2MZRKZBXOLCKE/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YSL3XWVDMSMKO23HR74AJQ6VEM3C2NTS/","https://security.gentoo.org/glsa/202008-01","https://security.netapp.com/advisory/ntap-20200731-0002/","https://usn.ubuntu.com/4428-1/","https://www.oracle.com/security-alerts/cpujan2021.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-20907","description":"In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-8624","versionConstraint":"< 7.35.0-1ubuntu2.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-8624","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.10"],"available":[{"date":"2016-11-03","kind":"advisory","version":"7.35.0-1ubuntu2.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8624","date":"2026-10-07","epss":0.06253,"percentile":0.9338}],"risk":3.1265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-8624"},"relatedVulnerabilities":[{"id":"CVE-2016-8624","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8624","date":"2026-10-07","epss":0.06253,"percentile":0.9338}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94103","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624","https://curl.haxx.se/docs/adv_20161102J.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5%40%3Ccommits.pulsar.apache.org%3E","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8624","description":"curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8624","versionConstraint":"< 7.35.0-1ubuntu2.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-8624","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.10"],"available":[{"date":"2016-11-03","kind":"advisory","version":"7.35.0-1ubuntu2.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8624","date":"2026-10-07","epss":0.06253,"percentile":0.9338}],"risk":3.1265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-8624"},"relatedVulnerabilities":[{"id":"CVE-2016-8624","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8624","date":"2026-10-07","epss":0.06253,"percentile":0.9338}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94103","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624","https://curl.haxx.se/docs/adv_20161102J.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5%40%3Ccommits.pulsar.apache.org%3E","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8624","description":"curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.10"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-8624","versionConstraint":"< 7.35.0-1ubuntu2.10 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-8624","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.10"],"available":[{"date":"2016-11-03","kind":"advisory","version":"7.35.0-1ubuntu2.10"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8624","date":"2026-10-07","epss":0.06253,"percentile":0.9338}],"risk":3.1265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-8624"},"relatedVulnerabilities":[{"id":"CVE-2016-8624","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2016-8624","cwe":"CWE-20","type":"Secondary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-8624","date":"2026-10-07","epss":0.06253,"percentile":0.9338}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/94103","http://www.securitytracker.com/id/1037192","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624","https://curl.haxx.se/docs/adv_20161102J.html","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5%40%3Ccommits.pulsar.apache.org%3E","https://security.gentoo.org/glsa/201701-47","https://www.tenable.com/security/tns-2016-21"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-8624","description":"curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them."}]},{"artifact":{"id":"b37dbcb586168da6","cpes":["cpe:2.3:a:busybox-initramfs:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox-initramfs:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox_initramfs:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox_initramfs:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_initramfs:1\\:1.21.0-1ubuntu1:*:*:*:*:*:*:*"],"name":"busybox-initramfs","purl":"pkg:deb/ubuntu/busybox-initramfs@1%3A1.21.0-1ubuntu1?arch=amd64&distro=ubuntu-14.04&upstream=busybox","type":"deb","version":"1:1.21.0-1ubuntu1","language":"","licenses":["sha256:336d995e819d3a7a3fdbf3f5041c07094f75ee849acb3bb742b7503d45786329"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/busybox-initramfs/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/busybox-initramfs/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/busybox-initramfs.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/busybox-initramfs.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/busybox-initramfs.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/busybox-initramfs.list"}],"upstreams":[{"name":"busybox"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:1.21.0-1ubuntu1.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-16544","versionConstraint":"< 1:1.21.0-1ubuntu1.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"busybox","version":"1:1.21.0-1ubuntu1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-16544","fix":{"state":"fixed","versions":["1:1.21.0-1ubuntu1.4"],"available":[{"date":"2019-04-03","kind":"advisory","version":"1:1.21.0-1ubuntu1.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-16544","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-16544","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-16544","date":"2026-10-07","epss":0.0624,"percentile":0.93367}],"risk":3.1199999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-16544"},"relatedVulnerabilities":[{"id":"CVE-2017-16544","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-16544","cwe":"CWE-94","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-16544","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-16544","date":"2026-10-07","epss":0.0624,"percentile":0.93367}],"urls":["http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html","http://packetstormsecurity.com/files/154536/VMware-Security-Advisory-2019-0013.html","http://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.html","http://seclists.org/fulldisclosure/2019/Jun/18","http://seclists.org/fulldisclosure/2019/Sep/7","http://seclists.org/fulldisclosure/2020/Aug/20","http://seclists.org/fulldisclosure/2020/Mar/15","http://seclists.org/fulldisclosure/2020/Sep/6","http://seclists.org/fulldisclosure/2021/Aug/21","http://seclists.org/fulldisclosure/2021/Jan/39","http://seclists.org/fulldisclosure/2022/Jun/36","http://www.vmware.com/security/advisories/VMSA-2019-0013.html","https://git.busybox.net/busybox/commit/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8","https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html","https://lists.debian.org/debian-lts-announce/2021/02/msg00020.html","https://seclists.org/bugtraq/2019/Jun/14","https://seclists.org/bugtraq/2019/Sep/7","https://us-cert.cisa.gov/ics/advisories/icsa-20-240-01","https://usn.ubuntu.com/3935-1/","https://www.twistlock.com/2017/11/20/cve-2017-16544-busybox-autocompletion-vulnerability/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16544","description":"In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature of the shell, used to get a list of filenames in a directory, does not sanitize filenames and results in executing any escape sequence in the terminal. This could potentially result in code execution, arbitrary file writes, or other attacks."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-1000257","versionConstraint":"< 7.35.0-1ubuntu2.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000257","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.12"],"available":[{"date":"2017-10-23","kind":"advisory","version":"7.35.0-1ubuntu2.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-07","epss":0.06224,"percentile":0.93355}],"risk":3.1119999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000257"},"relatedVulnerabilities":[{"id":"CVE-2017-1000257","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-07","epss":0.06224,"percentile":0.93355}],"urls":["http://www.debian.org/security/2017/dsa-4007","http://www.securityfocus.com/bid/101519","http://www.securitytracker.com/id/1039644","https://access.redhat.com/errata/RHSA-2017:3263","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20171023.html","https://security.gentoo.org/glsa/201712-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000257","description":"An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000257","versionConstraint":"< 7.35.0-1ubuntu2.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000257","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.12"],"available":[{"date":"2017-10-23","kind":"advisory","version":"7.35.0-1ubuntu2.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-07","epss":0.06224,"percentile":0.93355}],"risk":3.1119999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000257"},"relatedVulnerabilities":[{"id":"CVE-2017-1000257","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-07","epss":0.06224,"percentile":0.93355}],"urls":["http://www.debian.org/security/2017/dsa-4007","http://www.securityfocus.com/bid/101519","http://www.securitytracker.com/id/1039644","https://access.redhat.com/errata/RHSA-2017:3263","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20171023.html","https://security.gentoo.org/glsa/201712-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000257","description":"An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.12"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-1000257","versionConstraint":"< 7.35.0-1ubuntu2.12 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-1000257","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.12"],"available":[{"date":"2017-10-23","kind":"advisory","version":"7.35.0-1ubuntu2.12"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-07","epss":0.06224,"percentile":0.93355}],"risk":3.1119999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-1000257"},"relatedVulnerabilities":[{"id":"CVE-2017-1000257","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2017-1000257","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2017-1000257","date":"2026-10-07","epss":0.06224,"percentile":0.93355}],"urls":["http://www.debian.org/security/2017/dsa-4007","http://www.securityfocus.com/bid/101519","http://www.securitytracker.com/id/1039644","https://access.redhat.com/errata/RHSA-2017:3263","https://access.redhat.com/errata/RHSA-2018:2486","https://access.redhat.com/errata/RHSA-2018:3558","https://curl.haxx.se/docs/adv_20171023.html","https://security.gentoo.org/glsa/201712-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-1000257","description":"An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded."}]},{"artifact":{"id":"71081c257357e0b6","cpes":["cpe:2.3:a:perl:perl:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12837","versionConstraint":"< 5.18.2-2ubuntu1.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-12837","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.3"],"available":[{"date":"2017-11-13","kind":"advisory","version":"5.18.2-2ubuntu1.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-07","epss":0.06207,"percentile":0.93337}],"risk":3.1035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-12837"},"relatedVulnerabilities":[{"id":"CVE-2017-12837","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-07","epss":0.06207,"percentile":0.93337}],"urls":["http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100860","https://bugzilla.redhat.com/show_bug.cgi?id=1492091","https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131582","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12837","description":"Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier."}]},{"artifact":{"id":"b6e547621bce8e70","cpes":["cpe:2.3:a:perl-base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12837","versionConstraint":"< 5.18.2-2ubuntu1.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-12837","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.3"],"available":[{"date":"2017-11-13","kind":"advisory","version":"5.18.2-2ubuntu1.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-07","epss":0.06207,"percentile":0.93337}],"risk":3.1035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-12837"},"relatedVulnerabilities":[{"id":"CVE-2017-12837","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-07","epss":0.06207,"percentile":0.93337}],"urls":["http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100860","https://bugzilla.redhat.com/show_bug.cgi?id=1492091","https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131582","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12837","description":"Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier."}]},{"artifact":{"id":"9a3f82ec97b0252b","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/ubuntu/perl-modules@5.18.2-2ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12837","versionConstraint":"< 5.18.2-2ubuntu1.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-12837","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.3"],"available":[{"date":"2017-11-13","kind":"advisory","version":"5.18.2-2ubuntu1.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-07","epss":0.06207,"percentile":0.93337}],"risk":3.1035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-12837"},"relatedVulnerabilities":[{"id":"CVE-2017-12837","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12837","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12837","date":"2026-10-07","epss":0.06207,"percentile":0.93337}],"urls":["http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100860","https://bugzilla.redhat.com/show_bug.cgi?id=1492091","https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131582","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12837","description":"Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier."}]},{"artifact":{"id":"d654d35a4e09f2c2","cpes":["cpe:2.3:a:libsasl2-2:libsasl2-2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-2:libsasl2_2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2-2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_2:libsasl2_2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_2:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*"],"name":"libsasl2-2","purl":"pkg:deb/ubuntu/libsasl2-2@2.1.25.dfsg1-17build1?arch=amd64&distro=ubuntu-14.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.25.dfsg1-17build1","language":"","licenses":["sha256:8787c01bde77ae4cf4bc657eb3e19d57f285e7d57d71feec20ac3e3dd45610f8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-2/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libsasl2-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libsasl2-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-24407","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"cyrus-sasl2","version":"2.1.25.dfsg1-17build1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-24407","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-24407","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24407","date":"2026-10-07","epss":0.04123,"percentile":0.90525}],"risk":3.0922500000000004,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-24407"},"relatedVulnerabilities":[{"id":"CVE-2022-24407","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24407","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24407","date":"2026-10-07","epss":0.04123,"percentile":0.90525}],"urls":["http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst","https://lists.debian.org/debian-lts-announce/2022/03/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FIXU75Q6RBNK6UYM7MQ3TCFGXR7AX4U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H26R4SMGM3WHXX4XYNNJB4YGFIL5UNF4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZC6BMPI3V3MC2IGNLN377ETUWO7QBIH/","https://security.netapp.com/advisory/ntap-20221007-0003/","https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28","https://www.debian.org/security/2022/dsa-5087","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24407","description":"In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement."}]},{"artifact":{"id":"8b7bb767e1732fb3","cpes":["cpe:2.3:a:libsasl2-modules-db:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules-db:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules_db:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2-modules:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2_modules:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2-modules-db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*","cpe:2.3:a:libsasl2:libsasl2_modules_db:2.1.25.dfsg1-17build1:*:*:*:*:*:*:*"],"name":"libsasl2-modules-db","purl":"pkg:deb/ubuntu/libsasl2-modules-db@2.1.25.dfsg1-17build1?arch=amd64&distro=ubuntu-14.04&upstream=cyrus-sasl2","type":"deb","version":"2.1.25.dfsg1-17build1","language":"","licenses":["sha256:8787c01bde77ae4cf4bc657eb3e19d57f285e7d57d71feec20ac3e3dd45610f8"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsasl2-modules-db/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libsasl2-modules-db/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libsasl2-modules-db:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"cyrus-sasl2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-24407","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"cyrus-sasl2","version":"2.1.25.dfsg1-17build1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-24407","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-24407","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24407","date":"2026-10-07","epss":0.04123,"percentile":0.90525}],"risk":3.0922500000000004,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-24407"},"relatedVulnerabilities":[{"id":"CVE-2022-24407","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"impactScore":6.5,"exploitabilityScore":8},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-24407","cwe":"CWE-89","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-24407","date":"2026-10-07","epss":0.04123,"percentile":0.90525}],"urls":["http://www.openwall.com/lists/oss-security/2022/02/23/4","https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst","https://lists.debian.org/debian-lts-announce/2022/03/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FIXU75Q6RBNK6UYM7MQ3TCFGXR7AX4U/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H26R4SMGM3WHXX4XYNNJB4YGFIL5UNF4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZC6BMPI3V3MC2IGNLN377ETUWO7QBIH/","https://security.netapp.com/advisory/ntap-20221007-0003/","https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28","https://www.debian.org/security/2022/dsa-5087","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24407","description":"In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement."}]},{"artifact":{"id":"446829d742a92a16","cpes":["cpe:2.3:a:libgnutls-openssl27:libgnutls-openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls-openssl27:libgnutls_openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_openssl27:libgnutls-openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls_openssl27:libgnutls_openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls-openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*","cpe:2.3:a:libgnutls:libgnutls_openssl27:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*"],"name":"libgnutls-openssl27","purl":"pkg:deb/ubuntu/libgnutls-openssl27@2.12.23-12ubuntu2.5?arch=amd64&distro=ubuntu-14.04&upstream=gnutls26","type":"deb","version":"2.12.23-12ubuntu2.5","language":"","licenses":["sha256:12ca70c4bdcdff66bcbc6405d521f461b0cbb7bccf6d426e3ca6ef63ff132343"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls-openssl27/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libgnutls-openssl27/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls-openssl27:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libgnutls-openssl27:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls26"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.12.23-12ubuntu2.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5337","versionConstraint":"< 2.12.23-12ubuntu2.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnutls26","version":"2.12.23-12ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-5337","fix":{"state":"fixed","versions":["2.12.23-12ubuntu2.6"],"available":[{"date":"2017-02-01","kind":"advisory","version":"2.12.23-12ubuntu2.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5337","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5337","date":"2026-10-07","epss":0.06179,"percentile":0.93309}],"risk":3.0894999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-5337"},"relatedVulnerabilities":[{"id":"CVE-2017-5337","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5337","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5337","date":"2026-10-07","epss":0.06179,"percentile":0.93309}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://www.openwall.com/lists/oss-security/2017/01/10/7","http://www.openwall.com/lists/oss-security/2017/01/11/4","http://www.securityfocus.com/bid/95372","http://www.securitytracker.com/id/1037576","https://access.redhat.com/errata/RHSA-2017:2292","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=338","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=346","https://gitlab.com/gnutls/gnutls/commit/94fcf1645ea17223237aaf8d19132e004afddc1a","https://gnutls.org/security.html#GNUTLS-SA-2017-2","https://security.gentoo.org/glsa/201702-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5337","description":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate."}]},{"artifact":{"id":"45c8da2f19469884","cpes":["cpe:2.3:a:libgnutls26:libgnutls26:2.12.23-12ubuntu2.5:*:*:*:*:*:*:*"],"name":"libgnutls26","purl":"pkg:deb/ubuntu/libgnutls26@2.12.23-12ubuntu2.5?arch=amd64&distro=ubuntu-14.04&upstream=gnutls26","type":"deb","version":"2.12.23-12ubuntu2.5","language":"","licenses":["sha256:12ca70c4bdcdff66bcbc6405d521f461b0cbb7bccf6d426e3ca6ef63ff132343"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls26/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libgnutls26/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls26:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libgnutls26:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls26"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.12.23-12ubuntu2.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-5337","versionConstraint":"< 2.12.23-12ubuntu2.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnutls26","version":"2.12.23-12ubuntu2.5"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-5337","fix":{"state":"fixed","versions":["2.12.23-12ubuntu2.6"],"available":[{"date":"2017-02-01","kind":"advisory","version":"2.12.23-12ubuntu2.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-5337","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5337","date":"2026-10-07","epss":0.06179,"percentile":0.93309}],"risk":3.0894999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-5337"},"relatedVulnerabilities":[{"id":"CVE-2017-5337","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-5337","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-5337","date":"2026-10-07","epss":0.06179,"percentile":0.93309}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html","http://rhn.redhat.com/errata/RHSA-2017-0574.html","http://www.openwall.com/lists/oss-security/2017/01/10/7","http://www.openwall.com/lists/oss-security/2017/01/11/4","http://www.securityfocus.com/bid/95372","http://www.securitytracker.com/id/1037576","https://access.redhat.com/errata/RHSA-2017:2292","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=338","https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=346","https://gitlab.com/gnutls/gnutls/commit/94fcf1645ea17223237aaf8d19132e004afddc1a","https://gnutls.org/security.html#GNUTLS-SA-2017-2","https://security.gentoo.org/glsa/201702-04"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-5337","description":"Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate."}]},{"artifact":{"id":"b81880fd126d2468","cpes":["cpe:2.3:a:isc-dhcp-client:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-client:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_client:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_client:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*"],"name":"isc-dhcp-client","purl":"pkg:deb/ubuntu/isc-dhcp-client@4.2.4-7ubuntu12.4?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.4","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-client/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/isc-dhcp-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-client.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.list"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postinst"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.postrm"},{"path":"/var/lib/dpkg/info/isc-dhcp-client.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-client.preinst"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-25217","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-25217","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-25217","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25217","date":"2026-10-07","epss":0.06118,"percentile":0.9325}],"risk":3.0589999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-25217"},"relatedVulnerabilities":[{"id":"CVE-2021-25217","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":3.3,"impactScore":2.9,"exploitabilityScore":6.5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25217","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25217","date":"2026-10-07","epss":0.06118,"percentile":0.9325}],"urls":["http://www.openwall.com/lists/oss-security/2021/05/26/6","https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://kb.isc.org/docs/cve-2021-25217","https://lists.debian.org/debian-lts-announce/2021/06/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/","https://security.gentoo.org/glsa/202305-22","https://security.netapp.com/advisory/ntap-20220325-0011/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-25217","description":"In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted."}]},{"artifact":{"id":"c0a53a3f1b3af4cc","cpes":["cpe:2.3:a:isc-dhcp-common:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp-common:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp_common:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc-dhcp:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc_dhcp:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc-dhcp-common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*","cpe:2.3:a:isc:isc_dhcp_common:4.2.4-7ubuntu12.4:*:*:*:*:*:*:*"],"name":"isc-dhcp-common","purl":"pkg:deb/ubuntu/isc-dhcp-common@4.2.4-7ubuntu12.4?arch=amd64&distro=ubuntu-14.04&upstream=isc-dhcp","type":"deb","version":"4.2.4-7ubuntu12.4","language":"","licenses":["sha256:dadc60ccddc2890f0c34556fae8862a9353c0c720642af7b14065a733894c8ec"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/isc-dhcp-common/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/isc-dhcp-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/isc-dhcp-common.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/isc-dhcp-common.list"}],"upstreams":[{"name":"isc-dhcp"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-25217","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"isc-dhcp","version":"4.2.4-7ubuntu12.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2021-25217","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-25217","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25217","date":"2026-10-07","epss":0.06118,"percentile":0.9325}],"risk":3.0589999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-25217"},"relatedVulnerabilities":[{"id":"CVE-2021-25217","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"AV:A/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":3.3,"impactScore":2.9,"exploitabilityScore":6.5},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-officer@isc.org","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":7.4,"impactScore":4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-25217","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-25217","date":"2026-10-07","epss":0.06118,"percentile":0.9325}],"urls":["http://www.openwall.com/lists/oss-security/2021/05/26/6","https://cert-portal.siemens.com/productcert/pdf/ssa-406691.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://kb.isc.org/docs/cve-2021-25217","https://lists.debian.org/debian-lts-announce/2021/06/msg00002.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5QI4DYC7J4BGHEW3NH4XHMWTHYC36UK4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z2LB42JWIV4M4WDNXX5VGIP26FEYWKIF/","https://security.gentoo.org/glsa/202305-22","https://security.netapp.com/advisory/ntap-20220325-0011/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-25217","description":"In ISC DHCP 4.1-ESV-R1 -> 4.1-ESV-R16, ISC DHCP 4.4.0 -> 4.4.2 (Other branches of ISC DHCP (i.e., releases in the 4.0.x series or lower and releases in the 4.3.x series) are beyond their End-of-Life (EOL) and no longer supported by ISC. From inspection it is clear that the defect is also present in releases from those series, but they have not been officially tested for the vulnerability), The outcome of encountering the defect while reading a lease that will trigger it varies, according to: the component being affected (i.e., dhclient or dhcpd) whether the package was built as a 32-bit or 64-bit binary whether the compiler flag -fstack-protection-strong was used when compiling In dhclient, ISC has not successfully reproduced the error on a 64-bit system. However, on a 32-bit system it is possible to cause dhclient to crash when reading an improper lease, which could cause network connectivity problems for an affected system due to the absence of a running DHCP client process. In dhcpd, when run in DHCPv4 or DHCPv6 mode: if the dhcpd server binary was built for a 32-bit architecture AND the -fstack-protection-strong flag was specified to the compiler, dhcpd may exit while parsing a lease file containing an objectionable lease, resulting in lack of service to clients. Additionally, the offending lease and the lease immediately following it in the lease database may be improperly deleted. if the dhcpd server binary was built for a 64-bit architecture OR if the -fstack-protection-strong compiler flag was NOT specified, the crash will not occur, but it is possible for the offending lease and the lease which immediately followed it to be improperly deleted."}]},{"artifact":{"id":"ca5a3c322840464d","cpes":["cpe:2.3:a:libssl1.0.0:libssl1.0.0:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"libssl1.0.0","purl":"pkg:deb/ubuntu/libssl1.0.0@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04&upstream=openssl","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libssl1.0.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libssl1.0.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-10-07","epss":0.04002,"percentile":0.90268}],"risk":3.0015,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45447"},"relatedVulnerabilities":[{"id":"CVE-2026-45447","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-10-07","epss":0.04002,"percentile":0.90268}],"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"94a6d6bc2bd8219f","cpes":["cpe:2.3:a:openssl:openssl:1.0.1f-1ubuntu2.19:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.19?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.0.1f-1ubuntu2.19","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.0.0/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"openssl","version":"1.0.1f-1ubuntu2.19"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-10-07","epss":0.04002,"percentile":0.90268}],"risk":3.0015,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45447"},"relatedVulnerabilities":[{"id":"CVE-2026-45447","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-10-07","epss":0.04002,"percentile":0.90268}],"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"0065ef7930689165","cpes":["cpe:2.3:a:librtmp0:librtmp0:2.4\\+20121230.gitdf6c518-1:*:*:*:*:*:*:*"],"name":"librtmp0","purl":"pkg:deb/ubuntu/librtmp0@2.4%2B20121230.gitdf6c518-1?arch=amd64&distro=ubuntu-14.04&upstream=rtmpdump","type":"deb","version":"2.4+20121230.gitdf6c518-1","language":"","licenses":["sha256:4302abcc1ea1b6cbe8d19c79b892acf78878030220210707c19006828866207c"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/librtmp0/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/librtmp0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/librtmp0:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/librtmp0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"rtmpdump"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.4+20121230.gitdf6c518-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-8271","versionConstraint":"< 2.4+20121230.gitdf6c518-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"rtmpdump","version":"2.4+20121230.gitdf6c518-1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-8271","fix":{"state":"fixed","versions":["2.4+20121230.gitdf6c518-1ubuntu0.1"],"available":[{"date":"2017-05-09","kind":"advisory","version":"2.4+20121230.gitdf6c518-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2015-8271","cwe":"CWE-123","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-8271","date":"2026-10-07","epss":0.05923,"percentile":0.93058}],"risk":2.9615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-8271"},"relatedVulnerabilities":[{"id":"CVE-2015-8271","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-8271","cwe":"CWE-123","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-8271","date":"2026-10-07","epss":0.05923,"percentile":0.93058}],"urls":["http://www.debian.org/security/2017/dsa-3850","http://www.securityfocus.com/bid/95125","http://www.talosintelligence.com/reports/TALOS-2016-0067/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-8271","description":"The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.16"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-1000301","versionConstraint":"< 7.35.0-1ubuntu2.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000301","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.16"],"available":[{"date":"2018-05-16","kind":"advisory","version":"7.35.0-1ubuntu2.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-07","epss":0.0592,"percentile":0.93055}],"risk":2.96,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000301"},"relatedVulnerabilities":[{"id":"CVE-2018-1000301","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-07","epss":0.0592,"percentile":0.93055}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104225","http://www.securitytracker.com/id/1040931","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b138.html","https://lists.debian.org/debian-lts-announce/2018/05/msg00010.html","https://security.gentoo.org/glsa/201806-05","https://usn.ubuntu.com/3598-2/","https://usn.ubuntu.com/3648-1/","https://www.debian.org/security/2018/dsa-4202","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000301","description":"curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000301","versionConstraint":"< 7.35.0-1ubuntu2.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000301","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.16"],"available":[{"date":"2018-05-16","kind":"advisory","version":"7.35.0-1ubuntu2.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-07","epss":0.0592,"percentile":0.93055}],"risk":2.96,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000301"},"relatedVulnerabilities":[{"id":"CVE-2018-1000301","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-07","epss":0.0592,"percentile":0.93055}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104225","http://www.securitytracker.com/id/1040931","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b138.html","https://lists.debian.org/debian-lts-announce/2018/05/msg00010.html","https://security.gentoo.org/glsa/201806-05","https://usn.ubuntu.com/3598-2/","https://usn.ubuntu.com/3648-1/","https://www.debian.org/security/2018/dsa-4202","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000301","description":"curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-1000301","versionConstraint":"< 7.35.0-1ubuntu2.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-1000301","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.16"],"available":[{"date":"2018-05-16","kind":"advisory","version":"7.35.0-1ubuntu2.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-07","epss":0.0592,"percentile":0.93055}],"risk":2.96,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-1000301"},"relatedVulnerabilities":[{"id":"CVE-2018-1000301","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2018-1000301","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2018-1000301","date":"2026-10-07","epss":0.0592,"percentile":0.93055}],"urls":["http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html","http://www.securityfocus.com/bid/104225","http://www.securitytracker.com/id/1040931","https://access.redhat.com/errata/RHBA-2019:0327","https://access.redhat.com/errata/RHSA-2018:3157","https://access.redhat.com/errata/RHSA-2018:3558","https://access.redhat.com/errata/RHSA-2020:0544","https://access.redhat.com/errata/RHSA-2020:0594","https://curl.haxx.se/docs/adv_2018-b138.html","https://lists.debian.org/debian-lts-announce/2018/05/msg00010.html","https://security.gentoo.org/glsa/201806-05","https://usn.ubuntu.com/3598-2/","https://usn.ubuntu.com/3648-1/","https://www.debian.org/security/2018/dsa-4202","https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html","https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000301","description":"curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.. This vulnerability appears to have been fixed in curl < 7.20.0 and curl >= 7.60.0."}]},{"artifact":{"id":"71081c257357e0b6","cpes":["cpe:2.3:a:perl:perl:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-12883","versionConstraint":"< 5.18.2-2ubuntu1.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-12883","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.3"],"available":[{"date":"2017-11-13","kind":"advisory","version":"5.18.2-2ubuntu1.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-07","epss":0.05908,"percentile":0.93041}],"risk":2.954,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-12883"},"relatedVulnerabilities":[{"id":"CVE-2017-12883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-07","epss":0.05908,"percentile":0.93041}],"urls":["http://mirror.cucumberlinux.com/cucumber/cucumber-1.0/source/lang-base/perl/patches/CVE-2017-12883.patch","http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100852","https://bugzilla.redhat.com/show_bug.cgi?id=1492093","https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f#patch1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131598","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12883","description":"Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape."}]},{"artifact":{"id":"b6e547621bce8e70","cpes":["cpe:2.3:a:perl-base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.18.2-2ubuntu1.1?arch=amd64&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.shlibs","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-base.shlibs"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12883","versionConstraint":"< 5.18.2-2ubuntu1.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-12883","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.3"],"available":[{"date":"2017-11-13","kind":"advisory","version":"5.18.2-2ubuntu1.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-07","epss":0.05908,"percentile":0.93041}],"risk":2.954,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-12883"},"relatedVulnerabilities":[{"id":"CVE-2017-12883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-07","epss":0.05908,"percentile":0.93041}],"urls":["http://mirror.cucumberlinux.com/cucumber/cucumber-1.0/source/lang-base/perl/patches/CVE-2017-12883.patch","http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100852","https://bugzilla.redhat.com/show_bug.cgi?id=1492093","https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f#patch1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131598","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12883","description":"Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape."}]},{"artifact":{"id":"9a3f82ec97b0252b","cpes":["cpe:2.3:a:perl-modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules:5.18.2-2ubuntu1.1:*:*:*:*:*:*:*"],"name":"perl-modules","purl":"pkg:deb/ubuntu/perl-modules@5.18.2-2ubuntu1.1?arch=all&distro=ubuntu-14.04&upstream=perl","type":"deb","version":"5.18.2-2ubuntu1.1","language":"","licenses":["Artistic","Artistic-2","BSD-3-clause","BSD-3-clause-GENERIC","BSD-4-clause","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","S2P","SDBM-PUBLIC-DOMAIN","TEXT-SOUNDEX","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/perl-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.list"},{"path":"/var/lib/dpkg/info/perl-modules.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.postrm"},{"path":"/var/lib/dpkg/info/perl-modules.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/perl-modules.preinst"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.18.2-2ubuntu1.3"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-12883","versionConstraint":"< 5.18.2-2ubuntu1.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"perl","version":"5.18.2-2ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-12883","fix":{"state":"fixed","versions":["5.18.2-2ubuntu1.3"],"available":[{"date":"2017-11-13","kind":"advisory","version":"5.18.2-2ubuntu1.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-07","epss":0.05908,"percentile":0.93041}],"risk":2.954,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-12883"},"relatedVulnerabilities":[{"id":"CVE-2017-12883","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","metrics":{"baseScore":6.4,"impactScore":5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-12883","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-12883","date":"2026-10-07","epss":0.05908,"percentile":0.93041}],"urls":["http://mirror.cucumberlinux.com/cucumber/cucumber-1.0/source/lang-base/perl/patches/CVE-2017-12883.patch","http://www.debian.org/security/2017/dsa-3982","http://www.securityfocus.com/bid/100852","https://bugzilla.redhat.com/show_bug.cgi?id=1492093","https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f#patch1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.24.3-RC1","https://perl5.git.perl.org/perl.git/log/refs/tags/v5.26.1-RC1","https://rt.perl.org/Public/Bug/Display.html?id=131598","https://security.netapp.com/advisory/ntap-20180426-0001/","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-12883","description":"Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape."}]},{"artifact":{"id":"57604ba6c5c65d28","cpes":["cpe:2.3:a:libxml2:libxml2:2.9.1\\+dfsg1-3ubuntu4.8:*:*:*:*:*:*:*"],"name":"libxml2","purl":"pkg:deb/ubuntu/libxml2@2.9.1%2Bdfsg1-3ubuntu4.8?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"2.9.1+dfsg1-3ubuntu4.8","language":"","licenses":["sha256:c62eb0c67bff29c408efeb705ce0eabbfe74adf988c78b981b4402460fe73994"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libxml2/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libxml2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libxml2:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libxml2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2022-40304","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libxml2","version":"2.9.1+dfsg1-3ubuntu4.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2022-40304","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-40304","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-40304","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40304","date":"2026-10-07","epss":0.05812,"percentile":0.92944}],"risk":2.9059999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-40304"},"relatedVulnerabilities":[{"id":"CVE-2022-40304","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-40304","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-40304","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-40304","date":"2026-10-07","epss":0.05812,"percentile":0.92944}],"urls":["http://seclists.org/fulldisclosure/2022/Dec/21","http://seclists.org/fulldisclosure/2022/Dec/24","http://seclists.org/fulldisclosure/2022/Dec/25","http://seclists.org/fulldisclosure/2022/Dec/26","http://seclists.org/fulldisclosure/2022/Dec/27","https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b","https://gitlab.gnome.org/GNOME/libxml2/-/tags","https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3","https://security.netapp.com/advisory/ntap-20221209-0003/","https://support.apple.com/kb/HT213531","https://support.apple.com/kb/HT213533","https://support.apple.com/kb/HT213534","https://support.apple.com/kb/HT213535","https://support.apple.com/kb/HT213536"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-40304","description":"An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked."}]},{"artifact":{"id":"fb201b1c4c5a33b0","cpes":["cpe:2.3:a:curl:curl:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:deb/ubuntu/curl@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/curl/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/curl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/curl.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/curl.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.19"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2018-16839","versionConstraint":"< 7.35.0-1ubuntu2.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-16839","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.19"],"available":[{"date":"2018-10-31","kind":"advisory","version":"7.35.0-1ubuntu2.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-07","epss":0.05782,"percentile":0.929}],"risk":2.891,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-16839"},"relatedVulnerabilities":[{"id":"CVE-2018-16839","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-07","epss":0.05782,"percentile":0.929}],"urls":["http://www.securitytracker.com/id/1042012","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16839","https://curl.haxx.se/docs/CVE-2018-16839.html","https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3805-1/","https://www.debian.org/security/2018/dsa-4331"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16839","description":"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service."}]},{"artifact":{"id":"f79adb564028f2ba","cpes":["cpe:2.3:a:libcurl3:libcurl3:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3","purl":"pkg:deb/ubuntu/libcurl3@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16839","versionConstraint":"< 7.35.0-1ubuntu2.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-16839","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.19"],"available":[{"date":"2018-10-31","kind":"advisory","version":"7.35.0-1ubuntu2.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-07","epss":0.05782,"percentile":0.929}],"risk":2.891,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-16839"},"relatedVulnerabilities":[{"id":"CVE-2018-16839","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-07","epss":0.05782,"percentile":0.929}],"urls":["http://www.securitytracker.com/id/1042012","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16839","https://curl.haxx.se/docs/CVE-2018-16839.html","https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3805-1/","https://www.debian.org/security/2018/dsa-4331"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16839","description":"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service."}]},{"artifact":{"id":"e202091dacaf479e","cpes":["cpe:2.3:a:libcurl3-gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3-gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3_gnutls:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3-gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*","cpe:2.3:a:libcurl3:libcurl3_gnutls:7.35.0-1ubuntu2.6:*:*:*:*:*:*:*"],"name":"libcurl3-gnutls","purl":"pkg:deb/ubuntu/libcurl3-gnutls@7.35.0-1ubuntu2.6?arch=amd64&distro=ubuntu-14.04&upstream=curl","type":"deb","version":"7.35.0-1ubuntu2.6","language":"","licenses":["BSD-3-Clause","BSD-4-Clause","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libcurl3-gnutls/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libcurl3-gnutls/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libcurl3-gnutls:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"curl"}]},"matchDetails":[{"fix":{"suggestedVersion":"7.35.0-1ubuntu2.19"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-16839","versionConstraint":"< 7.35.0-1ubuntu2.19 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"curl","version":"7.35.0-1ubuntu2.6"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-16839","fix":{"state":"fixed","versions":["7.35.0-1ubuntu2.19"],"available":[{"date":"2018-10-31","kind":"advisory","version":"7.35.0-1ubuntu2.19"}]},"cvss":[],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-07","epss":0.05782,"percentile":0.929}],"risk":2.891,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-16839"},"relatedVulnerabilities":[{"id":"CVE-2018-16839","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-16839","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2018-16839","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-16839","date":"2026-10-07","epss":0.05782,"percentile":0.929}],"urls":["http://www.securitytracker.com/id/1042012","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16839","https://curl.haxx.se/docs/CVE-2018-16839.html","https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5","https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E","https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html","https://security.gentoo.org/glsa/201903-03","https://usn.ubuntu.com/3805-1/","https://www.debian.org/security/2018/dsa-4331"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16839","description":"Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service."}]},{"artifact":{"id":"b8f8825d31b322c8","cpes":["cpe:2.3:a:gcc-4.9-base:gcc-4.9-base:4.9.3-0ubuntu4:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9-base:gcc_4.9_base:4.9.3-0ubuntu4:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9_base:gcc-4.9-base:4.9.3-0ubuntu4:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9_base:gcc_4.9_base:4.9.3-0ubuntu4:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9:gcc-4.9-base:4.9.3-0ubuntu4:*:*:*:*:*:*:*","cpe:2.3:a:gcc-4.9:gcc_4.9_base:4.9.3-0ubuntu4:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc-4.9-base:4.9.3-0ubuntu4:*:*:*:*:*:*:*","cpe:2.3:a:gcc_4.9:gcc_4.9_base:4.9.3-0ubuntu4:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-4.9-base:4.9.3-0ubuntu4:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_4.9_base:4.9.3-0ubuntu4:*:*:*:*:*:*:*"],"name":"gcc-4.9-base","purl":"pkg:deb/ubuntu/gcc-4.9-base@4.9.3-0ubuntu4?arch=amd64&distro=ubuntu-14.04&upstream=gccgo-4.9","type":"deb","version":"4.9.3-0ubuntu4","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/gcc-4.9-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-4.9-base:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/gcc-4.9-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gccgo-4.9"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5739","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gccgo-4.9","version":"4.9.3-0ubuntu4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-5739","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5739","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5739","date":"2026-10-07","epss":0.09625,"percentile":0.9537}],"risk":2.8874999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-5739"},"relatedVulnerabilities":[{"id":"CVE-2015-5739","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5739","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5739","date":"2026-10-07","epss":0.09625,"percentile":0.9537}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html","http://rhn.redhat.com/errata/RHSA-2016-1538.html","http://seclists.org/oss-sec/2015/q3/237","http://seclists.org/oss-sec/2015/q3/292","http://seclists.org/oss-sec/2015/q3/294","http://www.securityfocus.com/bid/76281","https://bugzilla.redhat.com/show_bug.cgi?id=1250352","https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5739","description":"The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by \"Content Length\" instead of \"Content-Length.\""}]},{"artifact":{"id":"e2a8605b431e0210","cpes":["cpe:2.3:a:libgcc1:libgcc1:1\\:4.9.3-0ubuntu4:*:*:*:*:*:*:*"],"name":"libgcc1","purl":"pkg:deb/ubuntu/libgcc1@1%3A4.9.3-0ubuntu4?arch=amd64&distro=ubuntu-14.04&upstream=gccgo-4.9%404.9.3-0ubuntu4","type":"deb","version":"1:4.9.3-0ubuntu4","language":"","licenses":["sha256:24ccdc7d73310ccbceaf1a7a17c6517bc092b9aedb8faf2398a82e948f93f4fa"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-4.9-base/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libgcc1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc1:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libgcc1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gccgo-4.9","version":"4.9.3-0ubuntu4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2015-5739","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gccgo-4.9","version":"4.9.3-0ubuntu4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2015-5739","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2015-5739","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5739","date":"2026-10-07","epss":0.09625,"percentile":0.9537}],"risk":2.8874999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2015-5739"},"relatedVulnerabilities":[{"id":"CVE-2015-5739","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2015-5739","cwe":"CWE-444","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2015-5739","date":"2026-10-07","epss":0.09625,"percentile":0.9537}],"urls":["http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html","http://rhn.redhat.com/errata/RHSA-2016-1538.html","http://seclists.org/oss-sec/2015/q3/237","http://seclists.org/oss-sec/2015/q3/292","http://seclists.org/oss-sec/2015/q3/294","http://www.securityfocus.com/bid/76281","https://bugzilla.redhat.com/show_bug.cgi?id=1250352","https://github.com/golang/go/commit/117ddcb83d7f42d6aa72241240af99ded81118e9"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-5739","description":"The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling attacks via a space instead of a hyphen, as demonstrated by \"Content Length\" instead of \"Content-Length.\""}]},{"artifact":{"id":"7ab9aa3eab28a331","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:3.4-3ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:3.4-3ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:3.4-3ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:3.4-3ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:3.4-3ubuntu0.4:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:3.4-3ubuntu0.4:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/ubuntu/libtasn1-6@3.4-3ubuntu0.4?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4-3ubuntu0.4","language":"","licenses":["sha256:cb6a11ae4b6f32b5a507d6d8df1a1a8b7929917cf25362abb8191b46d92673b6"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.4-3ubuntu0.5"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-6891","versionConstraint":"< 3.4-3ubuntu0.5 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libtasn1-6","version":"3.4-3ubuntu0.4"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2017-6891","fix":{"state":"fixed","versions":["3.4-3ubuntu0.5"],"available":[{"date":"2017-06-05","kind":"advisory","version":"3.4-3ubuntu0.5"}]},"cvss":[],"cwes":[{"cve":"CVE-2017-6891","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-6891","date":"2026-10-07","epss":0.05585,"percentile":0.9268}],"risk":2.7925,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-6891"},"relatedVulnerabilities":[{"id":"CVE-2017-6891","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-6891","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2017-6891","date":"2026-10-07","epss":0.05585,"percentile":0.9268}],"urls":["http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=5520704d075802df25ce4ffccc010ba1641bd484","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html","http://www.debian.org/security/2017/dsa-3861","http://www.securityfocus.com/bid/98641","http://www.securitytracker.com/id/1038619","https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","https://secuniaresearch.flexerasoftware.com/advisories/76125/","https://secuniaresearch.flexerasoftware.com/secunia_research/2017-11/","https://security.gentoo.org/glsa/201710-11"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-6891","description":"Two errors in the \"asn1_find_node()\" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility."}]},{"artifact":{"id":"44e32ab1abfe6271","cpes":["cpe:2.3:a:ntpdate:ntpdate:1\\:4.2.6.p5\\+dfsg-3ubuntu2.14.04.8:*:*:*:*:*:*:*"],"name":"ntpdate","purl":"pkg:deb/ubuntu/ntpdate@1%3A4.2.6.p5%2Bdfsg-3ubuntu2.14.04.8?arch=amd64&distro=ubuntu-14.04&upstream=ntp","type":"deb","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8","language":"","licenses":["sha256:fb47405384448b41de8ca28218c2051389bb094b0197aeed0fa07a6c54b06faf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ntpdate/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/ntpdate/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.conffiles","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ntpdate.list","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.list"},{"path":"/var/lib/dpkg/info/ntpdate.postinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postinst"},{"path":"/var/lib/dpkg/info/ntpdate.postrm","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.postrm"},{"path":"/var/lib/dpkg/info/ntpdate.preinst","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/ntpdate.preinst"}],"upstreams":[{"name":"ntp"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.13"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-7185","versionConstraint":"< 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"ntp","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.8"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2018-7185","fix":{"state":"fixed","versions":["1:4.2.6.p5+dfsg-3ubuntu2.14.04.13"],"available":[{"date":"2018-07-09","kind":"advisory","version":"1:4.2.6.p5+dfsg-3ubuntu2.14.04.13"}]},"cvss":[],"epss":[{"cve":"CVE-2018-7185","date":"2026-10-07","epss":0.08998,"percentile":0.95148}],"risk":2.6994000000000002,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-7185"},"relatedVulnerabilities":[{"id":"CVE-2018-7185","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-7185","date":"2026-10-07","epss":0.08998,"percentile":0.95148}],"urls":["http://packetstormsecurity.com/files/146631/Slackware-Security-Advisory-ntp-Updates.html","http://support.ntp.org/bin/view/Main/NtpBug3454","http://www.securityfocus.com/archive/1/541824/100/0/threaded","http://www.securityfocus.com/bid/103339","https://security.FreeBSD.org/advisories/FreeBSD-SA-18:02.ntp.asc","https://security.gentoo.org/glsa/201805-12","https://security.netapp.com/advisory/ntap-20180626-0001/","https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us","https://usn.ubuntu.com/3707-1/","https://usn.ubuntu.com/3707-2/","https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","https://www.synology.com/support/security/Synology_SA_18_13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-7185","description":"The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the \"other side\" of an interleaved association causing the victim ntpd to reset its association."}]},{"artifact":{"id":"54f09b094723dd7d","cpes":["cpe:2.3:a:gnupg:gnupg:1.4.16-1ubuntu2.3:*:*:*:*:*:*:*"],"name":"gnupg","purl":"pkg:deb/ubuntu/gnupg@1.4.16-1ubuntu2.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.4.16-1ubuntu2.3","language":"","licenses":["GPL-3","GPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gnupg/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/gnupg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/gnupg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gnupg.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/gnupg.list"},{"path":"/var/lib/dpkg/info/gnupg.postinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/gnupg.postinst"},{"path":"/var/lib/dpkg/info/gnupg.preinst","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/gnupg.preinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.16-1ubuntu2.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6313","versionConstraint":"< 1.4.16-1ubuntu2.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnupg","version":"1.4.16-1ubuntu2.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6313","fix":{"state":"fixed","versions":["1.4.16-1ubuntu2.4"],"available":[{"date":"2016-08-18","kind":"advisory","version":"1.4.16-1ubuntu2.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6313","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6313","date":"2026-10-07","epss":0.03597,"percentile":0.89137}],"risk":2.69775,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6313"},"relatedVulnerabilities":[{"id":"CVE-2016-6313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6313","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6313","date":"2026-10-07","epss":0.03597,"percentile":0.89137}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-2674.html","http://www.debian.org/security/2016/dsa-3649","http://www.debian.org/security/2016/dsa-3650","http://www.securityfocus.com/bid/92527","http://www.securitytracker.com/id/1036635","http://www.ubuntu.com/usn/USN-3064-1","http://www.ubuntu.com/usn/USN-3065-1","https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=blob_plain%3Bf=NEWS","https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html","https://security.gentoo.org/glsa/201610-04","https://security.gentoo.org/glsa/201612-01"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6313","description":"The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits."}]},{"artifact":{"id":"f63526c0f98f2f89","cpes":["cpe:2.3:a:gpgv:gpgv:1.4.16-1ubuntu2.3:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/ubuntu/gpgv@1.4.16-1ubuntu2.3?arch=amd64&distro=ubuntu-14.04&upstream=gnupg","type":"deb","version":"1.4.16-1ubuntu2.3","language":"","licenses":["GPL-3","GPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:6650225473f35304cc2c16361c2dff345359ab3071e49cdb9cfd40edde121eab","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg"}]},"matchDetails":[{"fix":{"suggestedVersion":"1.4.16-1ubuntu2.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-6313","versionConstraint":"< 1.4.16-1ubuntu2.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"gnupg","version":"1.4.16-1ubuntu2.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6313","fix":{"state":"fixed","versions":["1.4.16-1ubuntu2.4"],"available":[{"date":"2016-08-18","kind":"advisory","version":"1.4.16-1ubuntu2.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6313","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6313","date":"2026-10-07","epss":0.03597,"percentile":0.89137}],"risk":2.69775,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6313"},"relatedVulnerabilities":[{"id":"CVE-2016-6313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6313","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6313","date":"2026-10-07","epss":0.03597,"percentile":0.89137}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-2674.html","http://www.debian.org/security/2016/dsa-3649","http://www.debian.org/security/2016/dsa-3650","http://www.securityfocus.com/bid/92527","http://www.securitytracker.com/id/1036635","http://www.ubuntu.com/usn/USN-3064-1","http://www.ubuntu.com/usn/USN-3065-1","https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=blob_plain%3Bf=NEWS","https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html","https://security.gentoo.org/glsa/201610-04","https://security.gentoo.org/glsa/201612-01"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6313","description":"The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits."}]},{"artifact":{"id":"7032542e2204fc2f","cpes":["cpe:2.3:a:libgcrypt11:libgcrypt11:1.5.3-2ubuntu4.3:*:*:*:*:*:*:*"],"name":"libgcrypt11","purl":"pkg:deb/ubuntu/libgcrypt11@1.5.3-2ubuntu4.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"1.5.3-2ubuntu4.3","language":"","licenses":["sha256:bb62570177902aeec265c42499f14af14934c4090b445ede084a93153409f824"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgcrypt11/copyright","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/usr/share/doc/libgcrypt11/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcrypt11:amd64.md5sums","layerID":"sha256:797bc5221591833a22069c8962f36f1632856446afb35bdaadd82b309cc12233","accessPath":"/var/lib/dpkg/info/libgcrypt11:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.5.3-2ubuntu4.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-6313","versionConstraint":"< 1.5.3-2ubuntu4.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"libgcrypt11","version":"1.5.3-2ubuntu4.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2016-6313","fix":{"state":"fixed","versions":["1.5.3-2ubuntu4.4"],"available":[{"date":"2016-08-18","kind":"advisory","version":"1.5.3-2ubuntu4.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2016-6313","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6313","date":"2026-10-07","epss":0.03597,"percentile":0.89137}],"risk":2.69775,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-6313"},"relatedVulnerabilities":[{"id":"CVE-2016-6313","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-6313","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-6313","date":"2026-10-07","epss":0.03597,"percentile":0.89137}],"urls":["http://rhn.redhat.com/errata/RHSA-2016-2674.html","http://www.debian.org/security/2016/dsa-3649","http://www.debian.org/security/2016/dsa-3650","http://www.securityfocus.com/bid/92527","http://www.securitytracker.com/id/1036635","http://www.ubuntu.com/usn/USN-3064-1","http://www.ubuntu.com/usn/USN-3065-1","https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=blob_plain%3Bf=NEWS","https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html","https://security.gentoo.org/glsa/201610-04","https://security.gentoo.org/glsa/201612-01"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-6313","description":"The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9740","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9740","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-07","epss":0.05372,"percentile":0.92444}],"risk":2.686,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9740"},"relatedVulnerabilities":[{"id":"CVE-2019-9740","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-07","epss":0.05372,"percentile":0.92444}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","http://www.securityfocus.com/bid/107466","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue36276","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190619-0005/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9740","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9740","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-07","epss":0.05372,"percentile":0.92444}],"risk":2.686,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9740"},"relatedVulnerabilities":[{"id":"CVE-2019-9740","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-07","epss":0.05372,"percentile":0.92444}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","http://www.securityfocus.com/bid/107466","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue36276","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190619-0005/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-9740","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9740","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-07","epss":0.05372,"percentile":0.92444}],"risk":2.686,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9740"},"relatedVulnerabilities":[{"id":"CVE-2019-9740","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-07","epss":0.05372,"percentile":0.92444}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","http://www.securityfocus.com/bid/107466","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue36276","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190619-0005/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"3ffe7f58e6bfc627","cpes":["cpe:2.3:a:python3.4-minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4-minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4_minimal:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:python3.4:python3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4-minimal","purl":"pkg:deb/ubuntu/python3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4-minimal.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.list"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.postrm"},{"path":"/var/lib/dpkg/info/python3.4-minimal.preinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.preinst"},{"path":"/var/lib/dpkg/info/python3.4-minimal.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4-minimal.prerm"}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-9740","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-9740","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-07","epss":0.05372,"percentile":0.92444}],"risk":2.686,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-9740"},"relatedVulnerabilities":[{"id":"CVE-2019-9740","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"impactScore":2.9,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2019-9740","cwe":"CWE-93","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-9740","date":"2026-10-07","epss":0.05372,"percentile":0.92444}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html","http://www.openwall.com/lists/oss-security/2021/02/04/2","http://www.securityfocus.com/bid/107466","https://access.redhat.com/errata/RHSA-2019:1260","https://access.redhat.com/errata/RHSA-2019:2030","https://access.redhat.com/errata/RHSA-2019:3335","https://access.redhat.com/errata/RHSA-2019:3520","https://access.redhat.com/errata/RHSA-2019:3725","https://bugs.python.org/issue36276","https://lists.debian.org/debian-lts-announce/2019/06/msg00022.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00023.html","https://lists.debian.org/debian-lts-announce/2019/06/msg00026.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2ORNTF62QPLMJXIQ7KTZQ2776LMIXEKL/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/44TS66GJMO5H3RLMVZEBGEFTB6O2LJJU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMWSKTNOHSUOT3L25QFJAVCFYZX46FYK/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXASHCDD4PQFKTMKQN4YOP5ZH366ABN4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://seclists.org/bugtraq/2019/Oct/29","https://security.gentoo.org/glsa/202003-26","https://security.netapp.com/advisory/ntap-20190619-0005/","https://usn.ubuntu.com/4127-1/","https://usn.ubuntu.com/4127-2/","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9740","description":"An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9."}]},{"artifact":{"id":"e0f5ea320a51575d","cpes":["cpe:2.3:a:libpython3.4-minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_minimal:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_minimal:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-minimal","purl":"pkg:deb/ubuntu/libpython3.4-minimal@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-minimal/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-minimal:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16056","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-16056","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-07","epss":0.05366,"percentile":0.92439}],"risk":2.683,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-16056"},"relatedVulnerabilities":[{"id":"CVE-2019-16056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-07","epss":0.05366,"percentile":0.92439}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3725","https://access.redhat.com/errata/RHSA-2019:3948","https://bugs.python.org/issue34155","https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html","https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20190926-0005/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."}]},{"artifact":{"id":"cd3d8d61dfe8155e","cpes":["cpe:2.3:a:libpython3.4-stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4-stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4_stdlib:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4-stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*","cpe:2.3:a:libpython3.4:libpython3.4_stdlib:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"libpython3.4-stdlib","purl":"pkg:deb/ubuntu/libpython3.4-stdlib@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04&upstream=python3.4","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpython3.4-minimal/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/libpython3.4-stdlib/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/libpython3.4-stdlib:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"python3.4"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-16056","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-16056","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-07","epss":0.05366,"percentile":0.92439}],"risk":2.683,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-16056"},"relatedVulnerabilities":[{"id":"CVE-2019-16056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-07","epss":0.05366,"percentile":0.92439}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3725","https://access.redhat.com/errata/RHSA-2019:3948","https://bugs.python.org/issue34155","https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html","https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20190926-0005/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."}]},{"artifact":{"id":"c4daacf257b094f8","cpes":["cpe:2.3:a:python3.4:python3.4:3.4.3-1ubuntu1\\~14.04.3:*:*:*:*:*:*:*"],"name":"python3.4","purl":"pkg:deb/ubuntu/python3.4@3.4.3-1ubuntu1~14.04.3?arch=amd64&distro=ubuntu-14.04","type":"deb","version":"3.4.3-1ubuntu1~14.04.3","language":"","licenses":["sha256:5a5a0f717c3d08707e97e140d590f6ac1a9e5c62f91953dc660398391a302cb4"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:6aa0584c61f61367ed8292e6815300a1f68b174f359cbcbf4d954220f86b0f3c","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/python3.4/copyright","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/usr/share/doc/python3.4/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.md5sums","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/python3.4.list","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.list"},{"path":"/var/lib/dpkg/info/python3.4.postinst","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postinst"},{"path":"/var/lib/dpkg/info/python3.4.postrm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.postrm"},{"path":"/var/lib/dpkg/info/python3.4.prerm","layerID":"sha256:1ef215608c778c5523a5f6540da8237e3d4d771f111b945538361237f283ea1a","accessPath":"/var/lib/dpkg/info/python3.4.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2019-16056","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"14.04"},"package":{"name":"python3.4","version":"3.4.3-1ubuntu1~14.04.3"},"namespace":"ubuntu:distro:ubuntu:14.04"}}],"vulnerability":{"id":"CVE-2019-16056","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-07","epss":0.05366,"percentile":0.92439}],"risk":2.683,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:14.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-16056"},"relatedVulnerabilities":[{"id":"CVE-2019-16056","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-16056","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2019-16056","date":"2026-10-07","epss":0.05366,"percentile":0.92439}],"urls":["http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00062.html","http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00063.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00012.html","http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html","https://access.redhat.com/errata/RHSA-2019:3725","https://access.redhat.com/errata/RHSA-2019:3948","https://bugs.python.org/issue34155","https://github.com/python/cpython/commit/8cb65d1381b027f0b09ee36bfed7f35bb4dec9a9","https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E","https://lists.debian.org/debian-lts-announce/2019/09/msg00018.html","https://lists.debian.org/debian-lts-announce/2019/09/msg00019.html","https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html","https://lists.debian.org/debian-lts-announce/2020/08/msg00034.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BEARDOTXCYPYELKBD2KWZ27GSPXDI3GQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COATURTCY7G67AYI6UDV5B2JZTBCKIDX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E2HP37NUVLQSBW3J735A2DQDOZ4ZGBLY/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ER6LONC2B2WYIO56GBQUDU6QTWZDPUNQ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K4KZEFP6E4YPYB52AF4WXCUDSGQOTF37/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K7HNVIFMETMFWWWUNTB72KYJYXCZOS5V/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NF3DRDGMVIRYNZMSLJIHNW47HOUQYXVG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OYGESQSGIHDCIGOBVF7VXCMIE6YDWRYB/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QASRD4E2G65GGEHYKVHYCXB2XWAGTNL4/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QP46PQSUKYPGWTADQ67NOV3BUN6JM34Z/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SDQQ56P7ZZR64XV5DUVWNSNXKKEXUG2J/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBTGPBUABGXZ7WH7677OEM3NSP6ZEA76/","https://security.netapp.com/advisory/ntap-20190926-0005/","https://usn.ubuntu.com/4151-1/","https://usn.ubuntu.com/4151-2/","https://www.oracle.com/security-alerts/cpuapr2020.html","https://www.oracle.com/security-alerts/cpujul2020.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-16056","description":"An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally."}]}],"grade":"F","score":"0.00","as_of":"2026-10-08T16:03:39.796Z","grype_db_version":"2026-10-08T06:33:47.000Z"}